CVE-2005-0100 Format string vulnerability in the movemail utility in (1) Emacs 20.x, 21.3, and possibly other versions, and (2) XEmacs 21.4 and earlier, allows remote malicious POP3 servers to execute arbitrary cod...
HighCVSS 7.5
EPSS 4.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Format string vulnerability in the movemail utility in (1) Emacs 20.x, 21.3, and possibly other versions, and (2) XEmacs 21.4 and earlier, allows remote malicious POP3 servers to execute arbitrary code via crafted packets.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU emacs | <= 20.0 | No fix listed |
| GNU emacs | = 21.3 | No fix listed |
| GNU xemacs | <= 21.4 | No fix listed |
| debian/xemacs21(Debian:12) | < 21.4.16-2 | 21.4.16-2 |
References
- 20050207 [USN-76-1] Emacs vulnerability mailing-list
- DSA-670 patch vendor-advisory
- DSA-671 patch vendor-advisory
- DSA-685 patch vendor-advisory
- MDKSA-2005:038 vendor-advisory
- RHSA-2005:110 patch vendor-advisory
- RHSA-2005:112 patch vendor-advisory
- RHSA-2005:133 patch vendor-advisory
- FLSA-2006:152898 vendor-advisory
- 12462 vdb-entry
- xemacs-movemail-format-string(19246) vdb-entry
- oval:org.mitre.oval:def:9408 signature vdb-entry
- Debian Security Tracker CVE-2005-0100 vendor-advisory