01 Record

CVE-2000-0844

Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as

UnratedPUBLISHEDCNA: mitre

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

Some functions that implement the locale subsystem on Unix do not properly cleanse user-injected format strings, which allows local attackers to execute arbitrary commands via functions such as

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 15.63% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 96.6% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Modified. NVD last modified this record on 2026-06-16.
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2001-01-22 05:00Z25 YR AGO

Last updated

2024-08-08 05:37Z2 YR AGO

Reserved

2000-10-18

Assigning CNA

mitre

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-264

Data version

5.1

Document digest

8ee182a93e22b847379e250c339894044ba02a15f927e98fa824bb46c49e3203

05 Affected products

VendorProductVersionsPlatforms

calderaopenlinuxNot specified—

calderaopenlinux_ebuilderNot specified—

calderaopenlinux_eserverNot specified—

conectivalinuxNot specified—

debiandebian_linuxNot specified—

ibmaixNot specified—

immuniximmunixNot specified—

mandrakesoftmandrake_linuxNot specified—

redhatlinuxNot specified—

sgiirixNot specified—

slackwareslackware_linuxNot specified—

sunsolarisNot specified—

sunsunosNot specified—

susesuse_linuxNot specified—

trustixsecure_linuxNot specified—

turbolinuxturbolinuxNot specified—

06 References

www.redhat.comRHSA-2000:057http://www.redhat.com/support/errata/RHSA-2000-057.htmlvendor-advisoryx_refsource_REDHAT
www.novell.com20000906 glibc locale security problemhttp://www.novell.com/linux/security/advisories/adv5_draht_glibc_txt.htmlvendor-advisoryx_refsource_SUSE
archives.neohapsis.com20000902 Conectiva Linux Security Announcement - glibchttp://archives.neohapsis.com/archives/bugtraq/2000-08/0436.htmlmailing-listx_refsource_BUGTRAQ
archives.neohapsis.comSSRT0689Uhttp://archives.neohapsis.com/archives/tru64/2000-q4/0000.htmlvendor-advisoryx_refsource_COMPAQ
www.turbolinux.comTLSA2000020-1http://www.turbolinux.com/pipermail/tl-security-announce/2000-September/000020.htmlvendor-advisoryx_refsource_TURBO
www.debian.org20000902 glibc: local root exploithttp://www.debian.org/security/2000/20000902vendor-advisoryx_refsource_DEBIAN
archives.neohapsis.com20000904 UNIX locale format string vulnerabilityhttp://archives.neohapsis.com/archives/bugtraq/2000-08/0457.htmlmailing-listx_refsource_BUGTRAQ
archives.neohapsis.comIY13753http://archives.neohapsis.com/archives/bugtraq/2000-10/0427.htmlvendor-advisoryx_refsource_AIXAPAR
www.securityfocus.com1634http://www.securityfocus.com/bid/1634vdb-entryx_refsource_BID
www.calderasystems.comCSSA-2000-030.0http://www.calderasystems.com/support/security/advisories/CSSA-2000-030.0.txtvendor-advisoryx_refsource_CALDERA
exchange.xforce.ibmcloud.comunix-locale-format-string(5176)https://exchange.xforce.ibmcloud.com/vulnerabilities/5176vdb-entryx_refsource_XF
patches.sgi.com20000901-01-Pftp://patches.sgi.com/support/free/security/advisories/20000901-01-Pvendor-advisoryx_refsource_SGI