CVE-2025-71263

Katalog CVE

CVSS 7.8 · High EPSS 0,19%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada opengroup unix. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

In UNIX Fourth Research Edition (v4), the su command is vulnerable to a buffer overflow due to the 'password' variable having a fixed size of 100 bytes. A local user can exploit this to gain root privileges. It is unlikely that UNIX v4 is running anywhere outside of a very small number of lab environments. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Rincian

Terbit di NVD

13 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

0,19% peluang dieksploitasi; lebih tinggi dari 7,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://discuss.systems/@ricci/115747843169814700 issue tracking
• https://sigma-star.at/blog/2025/12/unix-v4-buffer-overflow/ press/media coverage
• https://www.spinellis.gr/blog/20251223/ deskripsi teknis
• https://www.tuhs.org/pipermail/tuhs/2026-January/032991.html issue tracking · mailing list
• http://www.openwall.com/lists/oss-security/2026/03/20/6 issue tracking · mailing list
• http://www.openwall.com/lists/oss-security/2026/03/21/4 issue tracking · mailing list