Buffer overflow in stmkfont utility of HP-UX 10.0 through 11.22 allows local users to gain privileges via a long command line argument.

Exploit prediction (EPSS)

1.23% probability of exploitation in the next 30 days, higher than 69% of all scored CVEs.

Exploits and detections

• EDB-22247 HP-UX 10.x - stmkfont Alternate Typeface Library Buffer Overflow (2) · local · 2003-02-20
• EDB-22246 HP-UX 10.x - stmkfont Alternate Typeface Library Buffer Overflow (1) · local · 2003-02-12

CVSS scores

Classification

Weakness

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

• securityfocus.com /archive/1/324381 · mailing-list, x_refsource_BUGTRAQ, x_transferred
• exchange.xforce.ibmcloud.com /vulnerabilities/11313 · vdb-entry, x_refsource_XF, x_transferred
• oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5587 · vdb-entry, signature, x_refsource_OVAL, x_transferred
• securityfocus.com /advisories/4959 · vendor-advisory, x_refsource_HP, x_transferred
• securityreason.com /securityalert/3236 · third-party-advisory, x_refsource_SREASON, x_transferred
• securityfocus.com /bid/6836 · vdb-entry, x_refsource_BID, x_transferred

Sources

• CVE List: CVE-2003-1359
• NVD: CVE-2003-1359

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.