{"id":"CVE-2003-0143","title":"The pop_msg function in qpopper 4.0.x before 4.0.5fc2 does not null terminate a message buffer after a call to Qvsnprintf, which could allow","published":"2003-03-18T01:00:00.000Z","updated":"2026-06-16T18:01:38.173Z","severity":"critical","cvssScore":10,"epss":0.08604,"epssPct":0.95162,"kev":false,"maturity":"poc","actionScore":43,"primaryVendor":"qualcomm","primaryProduct":"qpopper","cweId":null,"fixAvailable":true,"tags":["pre-auth","rce","remote"],"epssDelta7":0,"summary":"The pop_msg function in qpopper 4.0.x before 4.0.5fc2 does not null terminate a message buffer after a call to Qvsnprintf, which could allow authenticated users to execute arbitrary code via a buffer overflow in a mdef command with a long macro name.","cvssVector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","cvssVersion":"2.0","cvssSource":"nvd-primary","cweName":null,"kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-08-08T01:43:36.007Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:43:10.209Z","exploitdb":"2026-11-13T03:17:58.683Z"},"cvssCna":null,"hasPatchRef":false,"credits":[],"counts":{"exploitdb":1,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"qualcomm","product":"qpopper","cpe":"cpe:2.3:a:qualcomm:qpopper"}],"references":[{"url":"http://marc.info/?l=bugtraq&m=104739841223916&w=2","tags":null},{"url":"http://marc.info/?l=bugtraq&m=104748775900481&w=2","tags":null},{"url":"http://marc.info/?l=bugtraq&m=104768137314397&w=2","tags":null},{"url":"http://marc.info/?l=bugtraq&m=104792541215354&w=2","tags":null},{"url":"http://www.debian.org/security/2003/dsa-259","tags":"Patch,Vendor Advisory"},{"url":"http://www.novell.com/linux/security/advisories/2003_018_qpopper.html","tags":null},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/11516","tags":null}],"exploits":[{"source":"exploitdb","kind":"remote","date":"2003-03-10"}],"analysis":null,"affectedVersions":[{"vendor":"qualcomm","product":"qpopper","version":"4.0.1","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"qualcomm","product":"qpopper","version":"4.0.2","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"qualcomm","product":"qpopper","version":"4.0.3","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"qualcomm","product":"qpopper","version":"4.0.4","vsi":null,"vse":null,"vei":null,"vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}