CVE-2003-0721

Published: Sep 17, 2003Modified: Apr 16, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

Integer signedness error in rfc2231_get_param from strings.c in PINE before 4.58 allows remote attackers to execute arbitrary code via an email that causes an out-of-bounds array access using a negative number.

Affected (1)

Products: Washington: Pine

Washington

1 product

Pine

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Washington Pine	Before 4.58

Related CWEs

CWE-129

Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

References (14)

http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009850.html

Source: cve@mitre.org

Broken Link

http://marc.info/?l=bugtraq&m=106329356702508&w=2

Source: cve@mitre.org

Third Party Advisory

http://marc.info/?l=bugtraq&m=106367213400313&w=2

Source: cve@mitre.org

Third Party Advisory

http://www.idefense.com/advisory/09.10.03.txt

Source: cve@mitre.org

Broken LinkExploitPatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2003-273.html

Source: cve@mitre.org

Broken LinkPatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2003-274.html

Source: cve@mitre.org

Broken Link

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A503

Source: cve@mitre.org

Broken Link

http://lists.grok.org.uk/pipermail/full-disclosure/2003-September/009850.html