Every CVE Search/ Get API key

CVE-2003-0161

The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not...

10.0 HighPublic exploitFix available

The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.

Exploit likelihood

38.8%Up 11.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 10.0

The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.

Record
CVE-2003-0161
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Updated
2026-11-02
CVE List No score

The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.

Record
CVE-2003-0161
Updated
2026-11-02
EUVDEUVD-2003-0157 No score

The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.

Record
EUVD-2003-0157
Updated
2026-11-03
GitHub AdvisoriesGHSA-2259-4w76-9w2p No score

The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not...

The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.

Record
GHSA-2259-4w76-9w2p
Updated
2026-11-02
OSV No score

The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.

Record
CVE-2003-0161
Updated
2026-11-02
OSVDEBIAN-CVE-2003-0161 No score

The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control value, allowing attackers to cause a denial of service and possibly execute arbitrary code via a buffer overflow attack using messages, a different vulnerability than CVE-2002-1337.

Record
DEBIAN-CVE-2003-0161
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sendmail
Debian:12
before 8.12.9-1
8.12.9-1
sendmail
Debian:13
before 8.12.9-1
8.12.9-1
sendmail
Debian:14
before 8.12.9-1
8.12.9-1
sendmail
Debian:3.0
before 8.12.3-6.3
8.12.3-6.3
sendmail-wide
Debian:3.0
before 8.12.3+3.5Wbeta-5.4
8.12.3+3.5Wbeta-5.4

Public exploits

Links only. Every CVE stores no exploit code.

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2003-0161 is a high vulnerability (CVSS 10.0) in Sendmail, published April 1, 2003. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 38.8%, the 98th percentile. Fixed in sendmail 8.12.9-1.

References

Show 17 moreShow less
MoveEnter Open