Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2001-0193 — Use of Externally-Controlled Format String in Linux

4 documents4 sources

Severity

7.2HIGHNVD

EPSS

0.2%

top 57.26%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Debian Linux Suse Linux

Timeline

PublishedMay 3

Latest updateApr 30

Description

Format string vulnerability in man in some Linux distributions allows local users to gain privileges via a malformed -l parameter.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages1 packages

▶NVDsuse/suse_linux6.3, 6.4, 7.0+2

Also affects: Debian Linux 2.2

Patches

Patch: www.debian.org ↗Patch: www.securityfocus.com ↗Patch: www.debian.org ↗

🔴Vulnerability Details

GHSA

GHSA-xgp2-f259-4rjq: Format string vulnerability in man in some Linux distributions allows local users to gain privileges via a malformed -l parameter↗2022-04-30

▶

CVEList

CVE-2001-0193: Format string vulnerability in man in some Linux distributions allows local users to gain privileges via a malformed -l parameter↗2001-05-07

▶

💥Exploits & PoCs

Exploit-DB

Debian 2.2 / Su.S.E 6.3/6.4/7.0 - man '-l' Format String↗2001-01-31

▶