CVE-2007-4135
The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the...
The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.
Exploit likelihood
What each source reports
NVD Score used
6.2
The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.
- Record
CVE-2007-4135- CVSS 2.0
- 6.2 Medium
AV:L/AC:H/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.
- Record
CVE-2007-4135- Updated
- 2026-11-02
EUVDEUVD-2007-4119 No score
The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.
- Record
EUVD-2007-4119- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rw5m-g76h-ww34 No score
The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the...
The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.
- Record
GHSA-rw5m-g76h-ww34- Updated
- 2026-11-02
OSV No score
The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.
- Record
CVE-2007-4135- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-4135 No score
The NFSv4 ID mapper (nfsidmap) before 0.17 does not properly handle return values from the getpwnam_r function when performing a username lookup, which can cause it to report a file as being owned by "root" instead of "nobody" if the file exists on the server but not on the client.
- Record
DEBIAN-CVE-2007-4135- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libnfsidmapDebian:11 |
before 0.18-0 | 0.18-0 |
nfs-utils-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
nfs-utils-lib-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
nfs-utils-lib-develRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
nfs-utils-libRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
nfs-utils-lib-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 2 CVEs |
before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
nfs-utils-libRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
nfs-utils-lib-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
nfs-utils-lib-develRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 0:1.0.8-7.2.z2 | 0:1.0.8-7.2.z2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-4135 is a medium vulnerability (CVSS 6.2) in Nfsv4 Nfsidmap, published September 5, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in libnfsidmap 0.18-0.
References
secunia.com/advisories/27043
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9864
redhat.com/support/errata/RHSA-2007-0951.html
novell.com/linux/security/advisories/2007_18_sr.html
securityfocus.com/bid/26767
mandriva.com/security/advisories?name=MDKSA-2007:240
Show 16 moreShow less
osvdb.org/45825
secunia.com/advisories/26674
exchange.xforce.ibmcloud.com/vulnerabilities/36396
nvd.nist.gov/vuln/detail/CVE-2007-4135
github.com/advisories/GHSA-rw5m-g76h-ww34
security-tracker.debian.org/tracker/CVE-2007-4135
access.redhat.com/errata/RHSA-2007:0951
access.redhat.com/security/updates/classification
bugzilla.redhat.com/show_bug.cgi?id=250973
bugzilla.redhat.com/show_bug.cgi?id=254040
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0951.json
access.redhat.com/security/cve/CVE-2007-3999
cve.org/CVERecord?id=CVE-2007-3999
nvd.nist.gov/vuln/detail/CVE-2007-3999
access.redhat.com/security/cve/CVE-2007-4135
cve.org/CVERecord?id=CVE-2007-4135