Every CVESearch/Get API key

CVE-2004-0393

Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote...

10.0 HighPublic exploitFix available

CVE-2004-0393 is a high vulnerability (CVSS 10.0) in Rlpr, published June 19, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 17.4%, the 97th percentile. Fixed in rlpr 2.02-7.1.

What does this mean?
Severity
10.0 HighCVSS 2.0, NVD
Exploit chance
17.4%EPSS, 97th percentile
Exploitation
None known2 public exploits
Fixed in
2.02-7.1rlpr +3 more

Description

Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function.

Exploit likelihood

17.4%Up 9.7 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rlpr
Debian:12
before 2.02-7.1
2.02-7.1
rlpr
Debian:13
before 2.02-7.1
2.02-7.1
rlpr
Debian:14
before 2.02-7.1
2.02-7.1
rlpr
Debian:3.0
From an advisory covering 2 CVEs
before 2.02-7woody1
2.02-7woody1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBRlpr 2.0 - 'msg()' Multiple Vulnerabilities2004-06-19
Exploit-DBRlpr 2.04 - 'msg()' Remote Format String2004-06-25

What each source reports

NVD Score used10.0

Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function.

Record
CVE-2004-0393
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Updated
2026-11-02
CVE ListNo score

Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function.

Record
CVE-2004-0393
Updated
2026-11-02
EUVDEUVD-2004-0393No score

Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function.

Record
EUVD-2004-0393
Updated
2026-11-03
GitHub AdvisoriesGHSA-mjcj-xgcf-w8x7No score

Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote...

Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function.

Record
GHSA-mjcj-xgcf-w8x7
Updated
2026-11-02
OSVNo score

Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function.

Record
CVE-2004-0393
Updated
2026-11-02
OSVDEBIAN-CVE-2004-0393No score

Format string vulnerability in the msg function for rlpr daemon (rlprd) 2.0.4 allows remote attackers to execute arbitrary code via format string specifiers in a buffer that can not be resolved, which is provided to the syslog function.

Record
DEBIAN-CVE-2004-0393
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open