CVE-2002-0246

HighCVSS 7.2/10Last modified Jun 16, 2026

Description

Format string vulnerability in the message catalog library functions in UnixWare 7.1.1 allows local users to gain privileges by modifying the LC_MESSAGE environment variable to read other message catalogs containing format strings from setuid programs such as vxprint.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://online.securityfocus.com/archive/1/255414Exploit, Vendor Advisory
http://www.iss.net/security_center/static/8113.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/4060
http://online.securityfocus.com/archive/1/255414Exploit, Vendor Advisory
http://www.iss.net/security_center/static/8113.phpPatch, Vendor Advisory
http://www.securityfocus.com/bid/4060

Timeline

Published: May 29, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-02477.2Buffer overflows in wmtv 0.6.5 and earlier may allow local users to gain privileges.CVE-2002-02487.2wmtv 0.6.5 and earlier allows local users to modify arbitrary files via a symlink attack on a configuration file.CVE-2002-02495.0PHP for Windows, when installed on Apache 2.0.28 beta as a standalone CGI module, allows remote attackers to obtain the physical path of the CVE-2002-02507.5Web configuration utility in HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier, allows unauthorized users CVE-2002-02517.5Buffer overflow in licq 1.0.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code v CVE-2002-02527.5Buffer overflow in Apple QuickTime Player 5.01 and 5.02 allows remote web servers to execute arbitrary code via a response containing a long CVE-2002-02535.0PHP, when not configured with the "display_errors = Off" setting in php.ini, allows remote attackers to obtain the physical path for an incl CVE-2002-02545.0ICQ 2001b Build 3659 allows remote attackers to cause a denial of service (crash) via a malformed picture that contains large height and wid CVE-2002-025510.0The default configuration of Arescom NetDSL 800 does not require authentication, which allows remote attackers to cause a denial of service CVE-2002-02565.0The telnet port in Arescom NetDSL 1000 router allows remote attackers to cause a denial of service via a series of connections with long str CVE-2002-02577.5Cross-site scripting vulnerability in auction.pl of MakeBid Auction Deluxe 3.30 allows remote attackers to obtain information from other use CVE-2002-02587.5Merak Mail IceWarp Web Mail uses a static identifier as a user session ID that does not change across sessions, which could allow remote att