PatchTheCVECVE-2001-0713: Sendmail before 8.12.1 does not properly drop privileges when the -C option is used to load custom configurati
CVE-2001-0713 is a medium-severity flaw (CVSS 4.6) affecting sendmail. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Sendmail before 8.12.1 does not properly drop privileges when the -C option is used to load custom configuration files, which allows local users to gain privileges via malformed arguments in the configuration file whose names contain characters with the high bit set, such as (1) macro names that are one character long, (2) a variable setting which is processed by the setoption function, or (3) a Modifiers setting which is processed by the getmodi
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.6 (Medium) |
| EPSS exploit chance | 0.3% (top 74%) |
| CISA exploited list | No |
| Published | 2001-10-30 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2001-0713?
sendmail: upgrade to newer than 8.12.1. Exact commands for each OS are on this page.
Is CVE-2001-0713 being exploited?
CVE-2001-0713 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2001-0713 affect?
CVE-2001-0713 affects sendmail. Severity is medium (CVSS 4.6). Sendmail before 8.12.1 does not properly drop privileges when the -C option is used to load custom configuration files, which allows local users to gain privileges via malformed arguments in the configuration file whose names contain charac
How urgent is CVE-2001-0713?
Priority 23/100. No elevated risk signals yet.
Related CVEs
- CVE-2023-51765 MEDIUM 5.3 UPGRADE UPGRADE sendmail through 8.17.2 allows SMTP smuggling in certain configurations
- CVE-2021-3618 HIGH 7.4 UPGRADE UPGRADE ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing differen
- CVE-2014-3956 LOW 1.9 UPGRADE UPGRADE The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and conseq
- CVE-2009-4565 HIGH 7.5 UPGRADE sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certi
- CVE-2009-1490 MEDIUM 5.0 UPGRADE Heap-based buffer overflow in Sendmail before 8.13.2 allows remote attackers to cause a denial of service (dae