CVE-2009-5153

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

In Novell NetWare before 6.5 SP8, a stack buffer overflow in processing of CALLIT RPC calls in the NFS Portmapper daemon in PKERNEL.NLM allowed remote unauthenticated attackers to execute code, because a length field was incorrectly trusted.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.suse.com/show_bug.cgi?id=515804Permissions Required, Third Party Advisory
https://download.novell.com/Download?buildid=1z3z-OsVCiE~Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-09-067/Third Party Advisory, VDB Entry
https://bugzilla.suse.com/show_bug.cgi?id=515804Permissions Required, Third Party Advisory
https://download.novell.com/Download?buildid=1z3z-OsVCiE~Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-09-067/Third Party Advisory, VDB Entry

Timeline

Published: Nov 21, 2018
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-51549.8An issue was discovered on MOBOTIX S14 MX-V4.2.1.61 devices. There is a default password of meinsm for the admin account.CVE-2009-51557.5In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to ca CVE-2009-51569.8An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string.CVE-2009-51578.8On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variab CVE-2009-51586.1The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.CVE-2009-51596.1Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment.