CVEvulnerability

CVE-2003-0143

10.0 HIGH Published 2003-03-18 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2003-03-18
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C

Description

The pop_msg function in qpopper 4.0.x before 4.0.5fc2 does not null terminate a message buffer after a call to Qvsnprintf, which could allow authenticated users to execute arbitrary code via a buffer overflow in a mdef command with a long macro name.

Affected configurations

• qualcomm qpopper 4.0.1 • qualcomm qpopper 4.0.2 • qualcomm qpopper 4.0.3 • qualcomm qpopper 4.0.4

Related

Referenced by CWE · observed example (1)

  • CWE-170 Improper Null Termination weakness

References