vulnwire
4.6med

CVE-2002-0973

Integer signedness error in several system calls for FreeBSD 4.6.1 RELEASE-p10 and earlier may allow attackers to access sensitive kernel m…

Published 24 y ago · modified 4 mo ago · JSON

CVSS
4.6
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 28%
Public exploits
0
none known

Integer signedness error in several system calls for FreeBSD 4.6.1 RELEASE-p10 and earlier may allow attackers to access sensitive kernel memory via large negative values to the (1) accept, (2) getsockname, and (3) getpeername system calls, and the (4) vesa FBIO_GETPALETTE ioctl.

Exploit prediction (EPSS)

0.35% probability of exploitation in the next 30 days, higher than 28% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.04.6AV:L/AC:L/Au:N/C:P/I:P/A:P

References

  • securityfocus.com /bid/5493 · vdb-entry, x_refsource_BID, x_transferred
  • marc.info /?l=bugtraq&m=102976839728706&w=2 · vendor-advisory, x_refsource_FREEBSD, x_transferred
  • iss.net /security_center/static/9903.php · vdb-entry, x_refsource_XF, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.