CVE-2003-0671: Jeremy Elson Tcpflow

High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days.

Format string vulnerability in tcpflow, when used in a setuid context, allows local users to execute arbitrary code via the device name argument, as demonstrated in Sustworks IPNetSentryX and IPNetMonitorX the setuid program RunTCPFlow.

Affected products

• Jeremy Elson Tcpflow: version 0.10 only; version 0.11 only; version 0.12 only; version 0.20 only

Published 2003-08-27. Last modified 2026-06-16.