7.8

CVE-2025-71263

Medienbericht
In UNIX Fourth Research Edition (v4), the su command is vulnerable to a buffer overflow due to the 'password' variable having a fixed size of 100 bytes. A local user can exploit this to gain root privileges. It is unlikely that UNIX v4 is running anywhere outside of a very small number of lab environments. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Opengroup ≫ Unix Version4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.075
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve@mitre.org 7.4 1.4 5.9
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
01.04.2026 09:15
https://sigma-star.at/blog/2025/12/unix-v4-buffer-overflow/
Press/Media Coverage
https://www.tuhs.org/pipermail/tuhs/2026-January/032991.html
Mailing List
Issue Tracking
https://discuss.systems/@ricci/115747843169814700
Issue Tracking
https://www.spinellis.gr/blog/20251223/
Technical Description
http://www.openwall.com/lists/oss-security/2026/03/20/6
Mailing List
Issue Tracking
http://www.openwall.com/lists/oss-security/2026/03/21/4
Mailing List
Issue Tracking