CVE-2001-1036
GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.90%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory.
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 0.90% probability · 58th percentile
- CISA KEV
- Not listed
- Affected
- gnu/findutils · slackware/slackware linux
- Source
- cve@mitre.org
References
- http://www.osvdb.org/5477
- http://www.securityfocus.com/archive/1/200991
- http://www.securityfocus.com/bid/3127Exploit, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/6932
- http://www.osvdb.org/5477
- http://www.securityfocus.com/archive/1/200991
- http://www.securityfocus.com/bid/3127Exploit, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/6932
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.