CVE-2004-0965

Severity: high (CVSS 7.2 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-02-09 · updated 2026-06-16

Description

stmkfont in HP-UX B.11.00 through B.11.23 relies on the user-specified PATH when executing certain commands, which allows local users to execute arbitrary code by modifying the PATH environment variable to point to malicious programs.

Affected products

Hewlett Packard Enterprise (HPE) HP-UX: 11.00, 11.11, 11.22, 11.23

References

http://marc.info/?l=bugtraq&m=109837243713696&w=2
http://www.nsfocus.com/english/homepage/research/0402.htm
http://www.securityfocus.com/advisories/7351
http://www.securityfocus.com/bid/11493
https://exchange.xforce.ibmcloud.com/vulnerabilities/17813
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5538
http://marc.info/?l=bugtraq&m=109837243713696&w=2
http://www.nsfocus.com/english/homepage/research/0402.htm
http://www.securityfocus.com/advisories/7351
http://www.securityfocus.com/bid/11493
https://exchange.xforce.ibmcloud.com/vulnerabilities/17813
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5538

Get alerted when CVE-2004-0965 or the next vulnerability affects your stack