{"cve":"CVE-2001-0713","nvd":{"published":"2001-10-30T05:00:00.000","modified":"2026-06-16T21:54:49.210","status":"Modified","description":"Sendmail before 8.12.1 does not properly drop privileges when the -C option is used to load custom configuration files, which allows local users to gain privileges via malformed arguments in the configuration file whose names contain characters with the high bit set, such as (1) macro names that are one character long, (2) a variable setting which is processed by the setoption function, or (3) a Modifiers setting which is processed by the getmodifiers function.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["http://razor.bindview.com/publish/advisories/adv_sm812.html","http://www.iss.net/security_center/static/7192.php","http://www.securityfocus.com/bid/3377","http://razor.bindview.com/publish/advisories/adv_sm812.html","http://www.iss.net/security_center/static/7192.php"],"products":["sendmail:sendmail"],"source":"nvd","synced_at":"2026-10-19T19:33:02.361923049+00:00"},"epss":{"cve":"CVE-2001-0713","score":0.00326,"percentile":0.25708,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}