CVE-2003-0962

Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote...

7.5 HighFix available

Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.

Exploit likelihood

23.5%Up 11.3 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.

Record: CVE-2003-0962
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.

Record: CVE-2003-0962
Updated: 2026-11-02

EUVDEUVD-2003-0952 No score

Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.

Record: EUVD-2003-0952
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wp4j-j8m8-qj4m No score

Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote...

Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.

Record: GHSA-wp4j-j8m8-qj4m
Updated: 2026-11-02

OSV No score

Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.

Record: CVE-2003-0962
Updated: 2026-11-02

OSVDEBIAN-CVE-2003-0962 No score

Heap-based buffer overflow in rsync before 2.5.7, when running in server mode, allows remote attackers to execute arbitrary code and possibly escape the chroot jail.

Record: DEBIAN-CVE-2003-0962
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`rsync` Debian:12	before 2.5.6-1.1	2.5.6-1.1
`rsync` Debian:13	before 2.5.6-1.1	2.5.6-1.1
`rsync` Debian:14	before 2.5.6-1.1	2.5.6-1.1
`rsync` Debian:3.0	before 2.5.5-0.2	2.5.5-0.2
`rsync` Red Hat:enterprise_linux:3::as	before 0:2.5.7-1	0:2.5.7-1
`rsync-debuginfo` Red Hat:enterprise_linux:3::as	before 0:2.5.7-1	0:2.5.7-1
`rsync` Red Hat:enterprise_linux:3::desktop	before 0:2.5.7-1	0:2.5.7-1
`rsync-debuginfo` Red Hat:enterprise_linux:3::desktop	before 0:2.5.7-1	0:2.5.7-1
`rsync` Red Hat:enterprise_linux:3::es	before 0:2.5.7-1	0:2.5.7-1
`rsync-debuginfo` Red Hat:enterprise_linux:3::es	before 0:2.5.7-1	0:2.5.7-1
`rsync` Red Hat:enterprise_linux:3::ws	before 0:2.5.7-1	0:2.5.7-1
`rsync-debuginfo` Red Hat:enterprise_linux:3::ws	before 0:2.5.7-1	0:2.5.7-1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2003-0962 is a high vulnerability (CVSS 7.5) in Andrew Tridgell Rsync, published December 4, 2003. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 23.5%, the 97th percentile. Fixed in rsync 2.5.6-1.1.

References

Show 31 moreShow less