CVE-2003-0028: Cray Unicos

High severity, CVSS 7.5. EPSS: 15% chance of exploitation in the next 30 days.

Integer overflow in the xdrmem_getbytes() function, and possibly other functions, of XDR (external data representation) libraries derived from SunRPC, including libnsl, libc, glibc, and dietlibc, allows remote attackers to execute arbitrary code via certain integer values in length fields, a different vulnerability than CVE-2002-0391.

Affected products

• Cray Unicos: version 6.0 only; version 6.0e only; version 6.1 only; version 7.0 only; version 8.0 only; version 8.3 only; …
• Freebsd Freebsd: version 4.0 only; version 4.1 only; version 4.1.1 only; version 4.2 only; version 4.3 only; version 4.4 only; …
• GNU Glibc: version 2.1 only; version 2.1.1 only; version 2.1.2 only; version 2.1.3 only; version 2.2 only; version 2.2.1 only; …
• HP HP-Ux: version 10.20 only; version 10.24 only; version 11.00 only; version 11.04 only; version 11.11 only; version 11.20 only; …
• HP HP-Ux Series 700: version 10.20 only
• HP HP-Ux Series 800: version 10.20 only
• IBM Aix: version 4.3.3 only; version 5.1 only; version 5.2 only
• Mit Kerberos 5: version 1.2 only; version 1.2.1 only; version 1.2.2 only; version 1.2.3 only; version 1.2.4 only; version 1.2.5 only; …
• Openafs Openafs: version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; version 1.0.4a only; …
• OpenBSD OpenBSD: version 2.0 only; version 2.1 only; version 2.2 only; version 2.3 only; version 2.4 only; version 2.5 only; …
• Sgi Irix: version 6.5 only; version 6.5.1 only; version 6.5.2 only; version 6.5.2f only; version 6.5.2m only; version 6.5.3 only; …
• Sun Solaris: version 2.5.1 only; version 2.6 only; version 7.0 only; version 8.0 only; version 9.0 only
• Sun Sunos: affected versions not specified; version 5.5.1 only; version 5.7 only; version 5.8 only

Published 2003-03-25. Last modified 2026-06-16.