CVE-2009-3699: IBM Aix

High severity, CVSS 10.0. EPSS: 62.3% chance of exploitation in the next 30 days.

Stack-based buffer overflow in libcsa.a (aka the calendar daemon library) in IBM AIX 5.x through 5.3.10 and 6.x through 6.1.3, and VIOS 2.1 and earlier, allows remote attackers to execute arbitrary code via a long XDR string in the first argument to procedure 21 of rpc.cmsd.

Affected products

• IBM Aix: version 5 only; version 5.1 only; version 5.1.0.10 only; version 5.1l only; version 5.2 only; version 5.2.0 only; …
• IBM Vios: up to and including 2.1.0; version 1.4 only; version 1.5.0 only; version 1.5.1 only; version 1.5.2 only

Published 2009-10-15. Last modified 2026-06-16.