CVE-2005-2878 Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via format string specifiers in the SEARCH command.
HighCVSS 7.5
EPSS 14.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via format string specifiers in the SEARCH command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNU mailutils | = 0.6 | No fix listed |
| debian/mailutils(Debian:12) | < 1:0.6.90-3 | 1:0.6.90-3 |
| debian/mailutils(Debian:13) | < 1:0.6.90-3 | 1:0.6.90-3 |
| debian/mailutils(Debian:14) | < 1:0.6.90-3 | 1:0.6.90-3 |
References
- Debian Security Tracker CVE-2005-2878 vendor-advisory
- bugs.debian.org issue-tracking
- 20050926 FreeBSD GNU Mailutils 0.6 imap4d exploit mailing-list
- savannah.gnu.org patch
- 16783 third-party-advisory
- 17020 third-party-advisory
- DSA-841 vendor-advisory
- GLSA-200509-10 vendor-advisory
- 20050909 GNU Mailutils 0.6 imap4d 'search' Format String Vulnerability exploit patch third-party-advisory vendor-advisory
- www.rosiello.org
- 14794 vdb-entry