Unscored severity · published Dec 31, 2003
CVE-2003-1167
misc.cpp in KPopup 0.9.1 trusts the PATH variable when executing killall, which allows local users to elevate their privileges by modifying the PATH variable to reference a…
–
CVSS
1%
EPSS
No
On KEV
Description
misc.cpp in KPopup 0.9.1 trusts the PATH variable when executing killall, which allows local users to elevate their privileges by modifying the PATH variable to reference a malicious killall program.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KP
Kpopup · Gernot Stocker
0.9.1; 0.9.5_pre2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-1167
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-1167
Patch
http://secunia.com/advisories/10105
Patch
http://www.osvdb.org/2742
Exploit
http://www.securityfocus.com/archive/1/342736
Exploit
http://www.securityfocus.com/bid/8915
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/13540
More from Kpopup
–
CVE-2003-1170
Format string vulnerability in main.cpp in kpopup 0.9.1 and 0.9.5pre2 allows local users to cause a denial of service (segmentation fault) and possibly execute arbitrary code via…