CVE-2000-1013

HighCVSS 7.2/10Last modified Sep 23, 2026

Description

The setlocale function in FreeBSD 5.0 and earlier, and possibly other OSes, allows local users to read arbitrary files via the LANG environmental variable.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected software

VendorProductVersions
n/an/an/a

Timeline

Published
Dec 11, 2000
Last modified
Sep 23, 2026
NVD status
Modified

Related CVEs from 2000

CVE-2000-10147.5Format string vulnerability in the search97.cgi CGI script in SCO help http server for Unixware 7 allows remote attackers to execute arbitraCVE-2000-10157.5The default configuration of Slashcode before version 2.0 Alpha has a default administrative password, which allows remote attackers to gainCVE-2000-10165.0The default configuration of Apache (httpd.conf) on SuSE 6.4 includes an alias for the /usr/doc directory, which allows remote attackers to CVE-2000-10175.0Webteachers Webdata allows remote attackers with valid Webdata accounts to read arbitrary files by posting a request to import the file intoCVE-2000-10182.1shred 1.0 file wiping utility does not properly open a file for overwriting or flush its buffers, which prevents shred from properly replaciCVE-2000-10195.0Search engine in Ultraseek 3.1 and 3.1.10 (aka Inktomi Search) allows remote attackers to cause a denial of service via a malformed URL.CVE-2000-10207.5Heap overflow in Worldclient in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrarCVE-2000-10217.5Heap overflow in WebConfig in Mdaemon 3.1.1 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary CVE-2000-10227.5The mailguard feature in Cisco Secure PIX Firewall 5.2(2) and earlier does not properly restrict access to SMTP commands, which allows remotCVE-2000-10237.5The Alabanza Control Panel does not require passwords to access administrative commands, which allows remote attackers to modify domain nameCVE-2000-102410.0eWave ServletExec 3.0C and earlier does not restrict access to the UploadServlet Java/JSP servlet, which allows remote attackers to upload fCVE-2000-10255.0eWave ServletExec JSP/Java servlet engine, versions 3.0C and earlier, allows remote attackers to cause a denial of service via a URL that co