CVE-2002-1337
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via...
CVE-2002-1337 is a high vulnerability (CVSS 10.0) in Sendmail, published March 4, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 72.6%, the 99th percentile. Fixed in sendmail 8.13.0.PreAlpha4-0.
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
- Record
CVE-2002-1337- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
- Record
CVE-2002-1337- Updated
- 2026-11-02
EUVDEUVD-2002-1321 No score
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
- Record
EUVD-2002-1321- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2vpw-h4q9-62fp No score
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via...
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
- Record
GHSA-2vpw-h4q9-62fp- Updated
- 2026-11-02
OSV No score
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
- Record
CVE-2002-1337- Updated
- 2026-11-02
OSVDEBIAN-CVE-2002-1337 No score
Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c.
- Record
DEBIAN-CVE-2002-1337- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sendmailDebian:12 |
before 8.13.0.PreAlpha4-0 | 8.13.0.PreAlpha4-0 |
sendmailDebian:13 |
before 8.13.0.PreAlpha4-0 | 8.13.0.PreAlpha4-0 |
sendmailDebian:14 |
before 8.13.0.PreAlpha4-0 | 8.13.0.PreAlpha4-0 |
sendmailDebian:3.0 |
before 8.12.3-5 | 8.12.3-5 |
sendmail-wideDebian:3.0 |
before 8.12.3+3.5Wbeta-5.2 | 8.12.3+3.5Wbeta-5.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Sendmail 8.12.x - Header Processing Buffer Overflow (1) | 2003-03-02 |
| Exploit-DB | Sendmail 8.12.x - Header Processing Buffer Overflow (2) | 2003-03-02 |
| Exploit-DB | Sendmail 8.11.x (Linux/i386) - Local Privilege Escalation | 2001-01-01 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
redhat.com/support/errata/RHSA-2003-073.html
www-1.ibm.com/support/search.wss?rs=0&q=IY40501&apar=only
marc.info?l=bugtraq&m=104678862109841&w=2
securityfocus.com/bid/6991
kb.cert.org/vuls/id/398025
Show 18 moreShow less
sendmail.org/8.12.8.html
debian.org/security/2003/dsa-257
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2222
cert.org/advisories/CA-2003-07.html
frontal2.mandriva.com/security/advisories?name=MDKSA-2003:028
iss.net/security_center/static/10748.php
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000571
nvd.nist.gov/vuln/detail/CVE-2002-1337
github.com/advisories/GHSA-2vpw-h4q9-62fp
security-tracker.debian.org/tracker/CVE-2002-1337