CVE-2003-0356

9.8 criticalEPSS 9.6%

Multiple off-by-one vulnerabilities in Ethereal 0.9.11 and earlier allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) AIM, (2) GIOP Gryphon, (3) OSPF, (4) PPTP, (5) Quake, (6) Quake2, (7) Quake3, (8) Rsync, (9) SMB, (10) SMPP, and (11) TSP dissectors, which do not properly use the tvb_get_nstringz and tvb_get_nstringz0 functions.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 9.6% chance of exploitation in the next 30 days; higher than 95% of CVEs (scores of 2026-10-31)
CWE: CWE-193
Published: 2003-06-09
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

ethereal:ethereal

References

http://www.debian.org/security/2003/dsa-313
http://www.ethereal.com/appnotes/enpa-sa-00009.html
http://www.kb.cert.org/vuls/id/641013
http://www.mandriva.com/security/advisories?name=MDKSA-2003:067
http://www.redhat.com/support/errata/RHSA-2003-077.html

Check your stack JSON