CVE-2001-0191: Andynorman Gnuserv

High severity, CVSS 10.0. EPSS: 5.5% chance of exploitation in the next 30 days.

gnuserv before 3.12, as shipped with XEmacs, does not properly check the specified length of an X Windows MIT-MAGIC-COOKIE cookie, which allows remote attackers to execute arbitrary commands via a buffer overflow, or brute force authentication by using a short cookie length.

Affected products

• Andynorman Gnuserv: before 3.12 (fixed in 3.12)

Published 2001-05-03. Last modified 2026-06-16.