Every CVE Search/ Get API key

CVE-2007-4135

The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the...

6.2 MediumFix available

The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.

Exploit likelihood

0.34%Down 0.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.2

The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.

Record
CVE-2007-4135
CVSS 2.0
6.2 MediumAV:L/AC:H/Au:N/C:C/I:C/A:C
Updated
2026-11-02
CVE List No score

The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.

Record
CVE-2007-4135
Updated
2026-11-02
EUVDEUVD-2007-4119 No score

The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.

Record
EUVD-2007-4119
Updated
2026-11-03
GitHub AdvisoriesGHSA-rw5m-g76h-ww34 No score

The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the...

The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.

Record
GHSA-rw5m-g76h-ww34
Updated
2026-11-02
OSV No score

The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.

Record
CVE-2007-4135
Updated
2026-11-02
OSVDEBIAN-CVE-2007-4135 No score

The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.

Record
DEBIAN-CVE-2007-4135
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libnfsidmap
Debian:11
before 0.18-0
0.18-0
nfs-utils-lib
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
before 0:1.0.8-7.2.z2
0:1.0.8-7.2.z2
nfs-utils-lib-debuginfo
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
before 0:1.0.8-7.2.z2
0:1.0.8-7.2.z2
nfs-utils-lib-devel
Red Hat:enterprise_linux:5::client_workstation
From an advisory covering 2 CVEs
before 0:1.0.8-7.2.z2
0:1.0.8-7.2.z2
nfs-utils-lib
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
before 0:1.0.8-7.2.z2
0:1.0.8-7.2.z2
nfs-utils-lib-debuginfo
Red Hat:enterprise_linux:5::client
From an advisory covering 2 CVEs
before 0:1.0.8-7.2.z2
0:1.0.8-7.2.z2
nfs-utils-lib
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
before 0:1.0.8-7.2.z2
0:1.0.8-7.2.z2
nfs-utils-lib-debuginfo
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
before 0:1.0.8-7.2.z2
0:1.0.8-7.2.z2
nfs-utils-lib-devel
Red Hat:enterprise_linux:5::server
From an advisory covering 2 CVEs
before 0:1.0.8-7.2.z2
0:1.0.8-7.2.z2

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2007-4135 is a medium vulnerability (CVSS 6.2) in Nfsv4 Nfsidmap, published September 5, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in libnfsidmap 0.18-0.

References

Show 16 moreShow less
MoveEnter Open