CVE-2003-0690

KDM in KDE 3.1.3 and earlier does not verify whether the pam_setcred function call succeeds,...

10.0 HighFix available

KDM in KDE 3.1.3 and earlier does not verify whether the pam_setcred function call succeeds, which may allow attackers to gain root privileges by triggering error conditions within PAM modules, as demonstrated in certain configurations of the MIT pam_krb5 module.

Exploit likelihood

3.10%Up 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 10.0

Record: CVE-2003-0690
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Updated: 2026-11-02

CVE List No score

Record: CVE-2003-0690
Updated: 2026-11-02

EUVDEUVD-2003-0681 No score

Record: EUVD-2003-0681
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r868-wrj2-9jfx No score

KDM in KDE 3.1.3 and earlier does not verify whether the pam_setcred function call succeeds,...

Record: GHSA-r868-wrj2-9jfx
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`kdebase` Debian:3.0	before 4:2.2.2-14.7	4:2.2.2-14.7
`xfree86` Debian:3.0	before 4.1.0-16woody3	4.1.0-16woody3

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2003-0690 is a high vulnerability (CVSS 10.0) in Kde, published September 18, 2003. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.10%, the 87th percentile. Fixed in kdebase 4:2.2.2-14.7.

References

Show 9 moreShow less