CVE-2000-0993: Freebsd

High severity, CVSS 7.2. EPSS: 1.7% chance of exploitation in the next 30 days.

Format string vulnerability in pw_error function in BSD libutil library allows local users to gain root privileges via a malformed password in commands such as chpass or passwd.

Affected products

• Freebsd Freebsd: version 3.2 only; version 3.3 only; version 3.4 only; version 3.5 only; version 4.0 only
• Netbsd Netbsd: version 1.4 only; version 1.4.1 only; version 1.4.2 only
• OpenBSD OpenBSD: version 2.3 only; version 2.4 only; version 2.5 only; version 2.6 only; version 2.7 only

Published 2000-12-19. Last modified 2026-09-23.