7.2high
CVE-2001-00871 exploit
itetris/xitetris 1.6.2 and earlier trusts the PATH environmental variable to find and execute the gunzip program, which allows local users…
Published 25 y ago · modified 4 mo ago · JSON
CVSS
7.2
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 60%
Public exploits
1
Exploit-DB
Summary
itetris/xitetris 1.6.2 and earlier trusts the PATH environmental variable to find and execute the gunzip program, which allows local users to gain root privileges by changing their PATH so that it points to a malicious gunzip program.
Exploit prediction (EPSS)
0.90% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.
Exploits and detections
- EDB-20517 Itetris 1.6.1/1.6.2 - Privileged Arbitrary Command Execution · local · 2000-12-19
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
References
- securityfocus.com /bid/2139 · vdb-entry, x_refsource_BID, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/5795 · vdb-entry, x_refsource_XF, x_transferred
- archives.neohapsis.com /archives/bugtraq/2000-12/0295.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
Sources
- CVE List: CVE-2001-0087
- NVD: CVE-2001-0087
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.