7.2high
CVE-2001-10361 exploit
GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb…
Published 25 y ago · modified 4 mo ago · JSON
CVSS
7.2
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 60%
Public exploits
1
Exploit-DB
Summary
GNU locate in findutils 4.1 on Slackware 7.1 and 8.0 allows local users to gain privileges via an old formatted filename database (locatedb) that contains an entry with an out-of-range offset, which causes locate to write to arbitrary process memory.
Exploit prediction (EPSS)
0.90% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.
Exploits and detections
- EDB-21043 GNU findutils 4.0/4.1 - Locate Arbitrary Command Execution · local · 2001-08-01
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
References
- exchange.xforce.ibmcloud.com /vulnerabilities/6932 · vdb-entry, x_refsource_XF, x_transferred
- securityfocus.com /bid/3127 · vdb-entry, x_refsource_BID, x_transferred
- securityfocus.com /archive/1/200991 · mailing-list, x_refsource_BUGTRAQ, x_transferred
- osvdb.org /5477 · vdb-entry, x_refsource_OSVDB, x_transferred
Sources
- CVE List: CVE-2001-1036
- NVD: CVE-2001-1036
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.