How severe is CVE-2003-0094?

CVE-2003-0094 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2003-0094 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (72nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2003-0094?

CVE-2003-0094 primarily affects Andries Brouwer Util-linux. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2003-0094?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2003-0094 published?

CVE-2003-0094 was published on 2003-03-03 and last updated on 2026-06-16.

CVE-2003-0094

CVE-2003-0094 is a medium-severity vulnerability in Andries Brouwer Util-linux with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 5.0)
EPSS exploit prediction: 2% (72nd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Andries Brouwer Util-linux
Published: 2003-03-03
Last modified: 2026-06-16

Description

A patch for mcookie in the util-linux package for Mandrake Linux 8.2 and 9.0 uses /dev/urandom instead of /dev/random, which causes mcookie to use an entropy source that is more predictable than expected, which may make it easier for certain types of attacks to succeed.

Frequently asked questions

What is CVE-2003-0094?: A patch for mcookie in the util-linux package for Mandrake Linux 8.2 and 9.0 uses /dev/urandom instead of /dev/random, which causes mcookie to use an entropy source that is more predictable than expected, which may make it easier for certain types of attacks to succeed.
How severe is CVE-2003-0094?: CVE-2003-0094 has a CVSS 2.0 base score of 5.0, rated medium severity.
Is CVE-2003-0094 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (72nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2003-0094?: CVE-2003-0094 primarily affects Andries Brouwer Util-linux. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2003-0094?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2003-0094 published?: CVE-2003-0094 was published on 2003-03-03 and last updated on 2026-06-16.

References

Affected products (2)

cpe:2.3:a:andries_brouwer:util-linux:2.11n:*:*:*:*:*:*:*
cpe:2.3:a:andries_brouwer:util-linux:2.11u:*:*:*:*:*:*:*

More vulnerabilities in Andries Brouwer Util-linux

CVE-2005-2876 — High (CVSS 7.2): umount in util-linux 2.8 to 2.12q, 2.13-pre1, and 2.13-pre2, and other packages such as loop-aes-utils, allows local…
CVE-2001-1175 — High (CVSS 7.2): vipw in the util-linux package before 2.10 causes /etc/shadow to be world-readable in some cases, which would make it…
CVE-2001-1147 — High (CVSS 7.2): The PAM implementation in /bin/login of the util-linux package before 2.11 causes a password entry to be rewritten…
CVE-2004-0080 — Medium (CVSS 5.0): The login program in util-linux 2.11 and earlier uses a pointer after it has been freed and reallocated, which could…
CVE-2006-7108 — Medium (CVSS 4.1): login in util-linux-2.12a skips pam_acct_mgmt and chauth_tok when authentication is skipped, such as when a Kerberos…

All CVEs affecting Andries Brouwer Util-linux →