CVE-2004-0103: crawl before 4.0.0 beta23 does not properly "apply a size check" when copying a certain environment variabl...

Security readout for executives and security teams

CVE-2004-0103 is an old local privilege-escalation issue in crawl before 4.0.0 beta23. A local user may be able to abuse unsafe environment-variable handling to gain higher privileges. The sources do not show remote exploitation, active exploitation, or a current CVSS score. Exposure is most likely limited to legacy systems that still have vulnerable crawl packages installed and allow local shell or account access. The provided affected-product metadata is incomplete, so inventory must rely on package names, installed versions, and vendor advisory mapping. Treat this as a legacy hygiene item unless crawl is present on shared systems. It does not justify emergency internet-wide response from the supplied evidence, but vulnerable local privilege-escalation bugs can matter on multi-user or exposed administrative hosts. Mitigation focus: Check vendor or distribution guidance, especially Debian DSA-432, for fixed packages.; Upgrade crawl to a non-affected version if still installed.; Remove crawl where it is not operationally required..

Prepared

Jun 30, 2026, 07:12 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.