CVE-2003-0161
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not...
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
Exploit likelihood
What each source reports
NVD Score used
10.0
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
- Record
CVE-2003-0161- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
- Record
CVE-2003-0161- Updated
- 2026-11-02
EUVDEUVD-2003-0157 No score
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
- Record
EUVD-2003-0157- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2259-4w76-9w2p No score
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not...
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
- Record
GHSA-2259-4w76-9w2p- Updated
- 2026-11-02
OSV No score
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
- Record
CVE-2003-0161- Updated
- 2026-11-02
OSVDEBIAN-CVE-2003-0161 No score
The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.
- Record
DEBIAN-CVE-2003-0161- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sendmailDebian:12 |
before 8.12.9-1 | 8.12.9-1 |
sendmailDebian:13 |
before 8.12.9-1 | 8.12.9-1 |
sendmailDebian:14 |
before 8.12.9-1 | 8.12.9-1 |
sendmailDebian:3.0 |
before 8.12.3-6.3 | 8.12.3-6.3 |
sendmail-wideDebian:3.0 |
before 8.12.3+3.5Wbeta-5.4 | 8.12.3+3.5Wbeta-5.4 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Sendmail 8.11.6 - Address Prescan Memory Corruption | 2003-03-29 |
| Exploit-DB | Sendmail 8.12.8 (BSD) - 'Prescan()' Remote Command Execution | 2003-04-30 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2003-0161 is a high vulnerability (CVSS 10.0) in Sendmail, published April 1, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 38.8%, the 98th percentile. Fixed in sendmail 8.12.9-1.
References
sunsolve.sun.com/search/document.do?assetkey=1-77-1001088.1-1
sunsolve.sun.com/search/document.do?assetkey=1-26-52620-1
securityfocus.com/bid/7230
marc.info?l=bugtraq&m=104914999806315&w=2
redhat.com/support/errata/RHSA-2003-120.html
securityfocus.com/archive/1/317135/30/25220/threaded
Show 17 moreShow less
debian.org/security/2003/dsa-278
debian.org/security/2003/dsa-290
lists.apple.com/mhonarc/security-announce/msg00028.html
sunsolve.sun.com/search/document.do?assetkey=1-26-52700-1
cert.org/advisories/CA-2003-12.html
securityfocus.com/archive/1/316961/30/25250/threaded
redhat.com/support/errata/RHSA-2003-121.html
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000614
gentoo.org/security/en/glsa/glsa-200303-27.xml
lists.grok.org.uk/pipermail/full-disclosure/2003-March/004295.html
marc.info?l=bugtraq&m=104897487512238&w=2
securityfocus.com/archive/1/321997
marc.info?l=bugtraq&m=104896621106790&w=2
kb.cert.org/vuls/id/897604
nvd.nist.gov/vuln/detail/CVE-2003-0161
github.com/advisories/GHSA-2259-4w76-9w2p
security-tracker.debian.org/tracker/CVE-2003-0161