{"id":"CVE-2002-0525","aliases":["EUVD-2002-0520","GHSA-xrg7-wh2g-5jmq"],"status":"published","title":"Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local...","description":"Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local users and remote malicious NNTP servers to gain privileges via format string specifiers in NTTP responses.","severity":{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.04121,"percentile":0.9086,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2002-06-11T04:00:00Z","modified":"2026-06-16T21:57:36Z","exploits":[{"source":"exploitdb","id":"EDB-21375","title":"ISC INN 2.0/2.1/2.2.x - Multiple Local Format String Vulnerabilities","type":"local","platform":"linux","date":"2002-04-11","verified":true,"url":"https://www.exploit-db.com/exploits/21375"}],"products":[{"vendor":"isc","product":"inn"}],"references":[{"url":"http://www.securityfocus.com/bid/4501","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit","Patch","Vendor Advisory"]},{"url":"http://www.iss.net/security_center/static/8834.php","tags":["vdb-entry","x_refsource_XF","x_transferred","Vendor Advisory"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2002-04/0140.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2002-0525"},{"url":"https://github.com/advisories/GHSA-xrg7-wh2g-5jmq"}],"sources":{"cve":[{"id":"CVE-2002-0525","description":"Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local users and remote malicious NNTP servers to gain privileges via format string specifiers in NTTP responses.","status":"published","published":"2002-06-11T04:00:00Z","modified":"2024-08-08T02:49:28.777Z","updated_at":"2026-11-02T14:33:55.303902Z"}],"euvd":[{"id":"EUVD-2002-0520","description":"Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local users and remote malicious NNTP servers to gain privileges via format string specifiers in NTTP responses.","status":"published","published":"2002-06-11T04:00:00Z","modified":"2024-08-08T02:49:28Z","updated_at":"2026-11-03T01:15:00.542292Z"}],"ghsa":[{"id":"GHSA-xrg7-wh2g-5jmq","title":"Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local...","description":"Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local users and remote malicious NNTP servers to gain privileges via format string specifiers in NTTP responses.","status":"published","published":"2022-04-30T18:19:24Z","modified":"2023-01-30T05:05:51Z","updated_at":"2026-11-02T14:47:22.035472Z"}],"nvd":[{"id":"CVE-2002-0525","description":"Format string vulnerabilities in (1) inews or (2) rnews for INN 2.2.3 and earlier allow local users and remote malicious NNTP servers to gain privileges via format string specifiers in NTTP responses.","status":"published","published":"2002-08-12T04:00:00Z","modified":"2026-06-16T21:57:36.587Z","cvss":[{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:00:42.220505Z"}]}}