CVE-2003-0949

MediumCVSS 4.6/10Last modified Jun 16, 2026

Description

xsok 1.02 does not properly drop privileges before finding and executing the "gunzip" program, which allows local users to execute arbitrary commands.

Metrics

CVSS 2.0 4.6/10AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2003/dsa-405Patch, Vendor Advisory
http://www.securityfocus.com/bid/9321Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/14098
http://www.debian.org/security/2003/dsa-405Patch, Vendor Advisory
http://www.securityfocus.com/bid/9321Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/14098

Timeline

Published: Feb 3, 2004
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2003

CVE-2003-09507.5PeopleSoft PeopleTools 8.1x, 8.2x, and 8.4x allows remote attackers to execute arbitrary commands by uploading a file to the IClient Servlet CVE-2003-09517.5Partition Manager (parmgr) in HP-UX B.11.23 does not properly validate certificates that are provided by the cimserver, which allows attacke CVE-2003-09547.2Buffer overflow in rcp for AIX 4.3.3, 5.1 and 5.2 allows local users to gain privileges.CVE-2003-09554.6OpenBSD kernel 3.3 and 3.4 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code in 3.4 via a p CVE-2003-09562.6Multiple race conditions in the handling of O_DIRECT in Linux kernel prior to version 2.4.22 could cause stale data to be returned from the CVE-2003-095910.0Multiple integer overflows in the 32bit emulation for AMD64 architectures in Linux 2.4 kernel before 2.4.21 allows attackers to cause a deni CVE-2003-09607.5OpenCA before 0.9.1.4 does not use the correct certificate in a chain to check the serial, which could cause OpenCA to accept revoked or exp CVE-2003-09617.2Integer overflow in the do_brk function for the brk system call in Linux kernel 2.4.22 and earlier allows local users to gain root privilege CVE-2003-09627.5Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibl CVE-2003-09637.5Buffer overflows in (1) try_netscape_proxy and (2) try_squid_eplf for lftp 2.6.9 and earlier allow remote HTTP servers to execute arbitrary CVE-2003-09656.8Cross-site scripting (XSS) vulnerability in the admin CGI script for Mailman before 2.1.4 allows remote attackers to steal session cookies a CVE-2003-09667.5Buffer overflow in the frm command in elm 2.5.6 and earlier, and possibly later versions, allows remote attackers to execute arbitrary code