CVE-2003-0694

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 66.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2003-10-06 · updated 2026-06-16

Description

The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.

Affected products

macOS: 10.2, 10.2.1, 10.2.2, 10.2.3, 10.2.4, 10.2.5 (+1)
Apple Mac Os X Server: 10.2, 10.2.1, 10.2.2, 10.2.3, 10.2.4, 10.2.5 (+1)
Compaq Tru64: 4.0f, 4.0f_pk6_bl17, 4.0f_pk7_bl18, 4.0f_pk8_bl22, 4.0g, 4.0g_pk3_bl17 (+15)
FreeBSD: 3.0-releng, 4.0-releng, 4.3-release_p38, 4.3-releng, 4.4-release_p42, 4.4-releng (+13)
gentoo Linux: 0.5, 0.7, 1.1a, 1.2, 1.4-rc1, 1.4-rc2 (+1)
Hewlett Packard Enterprise (HPE) HP-UX: 11.00, 11.0.4, 11.11, 11.22
IBM AIX: 4.3.3, 5.1, 5.2
Netbsd: 1.4.3, 1.5, 1.5.1, 1.5.2, 1.5.3, 1.6 (+2)
Sendmail Advanced Message Server: 1.2, 1.3
Sendmail: 2.6, 2.6.1, 2.6.2, 3.0, 3.0.1, 3.0.2 (+31)
Sendmail Pro: 8.9.2, 8.9.3
Sendmail Switch: 2.1, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5 (+10)
Sgi Irix: 6.5.15, 6.5.16, 6.5.17f, 6.5.17m, 6.5.18f, 6.5.18m (+6)
Sun Solaris: 2.6, 7.0, 8.0, 9.0
Sunos: 5.7, 5.8
Turbolinux Advanced Server: 6.0
Turbolinux Server: 6.1, 6.5, 7.0, 8.0
Turbolinux Workstation: 6.0, 7.0, 8.0

References

Get alerted when CVE-2003-0694 or the next vulnerability affects your stack