CVE-1999-1165: GNU Fingerd

High severity, CVSS 7.2. EPSS: 0.5% chance of exploitation in the next 30 days.

GNU fingerd 1.37 does not properly drop privileges before accessing user information, which could allow local users to (1) gain root privileges via a malicious program in the .fingerrc file, or (2) read arbitrary files via symbolic links from .plan, .forward, or .project files.

Affected products

• GNU Fingerd: version 1.37 only

Published 1999-07-21. Last modified 2026-06-16.