PT-2003-1817 · Washington University · Pine

Zen-Parse

·

Published

2003-09-12

·

Updated

2024-02-09

·

CVE-2003-0721

CVSS v2.0

7.5

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions: PINE versions prior to 4.58
Description: The issue is related to an integer signedness error in the rfc2231 get param function from strings.c. This error allows remote attackers to execute arbitrary code via an email that causes an out-of-bounds array access using a negative number.
Recommendations: For versions prior to 4.58, update to version 4.58 or later to resolve the issue. As a temporary workaround, consider restricting access to emails that could potentially exploit this issue until a patch is applied.

Exploit

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2003-0721

Affected Products

Pine