CVE-2005-0100

Format string vulnerability in the movemail utility in (1) Emacs 20.x, 21.3, and possibly other versions, and (2) XEmacs 21.4 and earlier, allows remote malicious POP3 servers to execute arbitrary code via crafted packets.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.debian.org/security/2005/dsa-670	Patch Vendor Advisory
http://www.debian.org/security/2005/dsa-671	Patch Vendor Advisory
http://www.debian.org/security/2005/dsa-685	Patch Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-110.html	Patch Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-112.html	Patch Vendor Advisory
http://www.redhat.com/support/errata/RHSA-2005-133.html	Patch Vendor Advisory
http://www.securityfocus.com/bid/12462
http://www.mandriva.com/security/advisories?name=MDKSA-2005:038
http://marc.info/?l=bugtraq&m=110780416112719&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/19246
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9408
http://www.securityfocus.com/archive/1/433928/30/5010/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gnu:emacs:21.3:::::::*
	cpe:2.3:a:gnu:emacs::::::::
	cpe:2.3:a:gnu:xemacs::::::::

Information

Published : 2005-02-06 21:00

Updated : 2018-10-19 08:31

NVD link : CVE-2005-0100

Mitre link : CVE-2005-0100

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

gnu

xemacs
emacs

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.debian.org/security/2005/dsa-670", "name": "DSA-670", "tags": ["Patch", "Vendor Advisory"], "refsource": "DEBIAN"}, {"url": "http://www.debian.org/security/2005/dsa-671", "name": "DSA-671", "tags": ["Patch", "Vendor Advisory"], "refsource": "DEBIAN"}, {"url": "http://www.debian.org/security/2005/dsa-685", "name": "DSA-685", "tags": ["Patch", "Vendor Advisory"], "refsource": "DEBIAN"}, {"url": "http://www.redhat.com/support/errata/RHSA-2005-110.html", "name": "RHSA-2005:110", "tags": ["Patch", "Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://www.redhat.com/support/errata/RHSA-2005-112.html", "name": "RHSA-2005:112", "tags": ["Patch", "Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://www.redhat.com/support/errata/RHSA-2005-133.html", "name": "RHSA-2005:133", "tags": ["Patch", "Vendor Advisory"], "refsource": "REDHAT"}, {"url": "http://www.securityfocus.com/bid/12462", "name": "12462", "tags": [], "refsource": "BID"}, {"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2005:038", "name": "MDKSA-2005:038", "tags": [], "refsource": "MANDRAKE"}, {"url": "http://marc.info/?l=bugtraq&m=110780416112719&w=2", "name": "20050207 [USN-76-1] Emacs vulnerability", "tags": [], "refsource": "BUGTRAQ"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19246", "name": "xemacs-movemail-format-string(19246)", "tags": [], "refsource": "XF"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9408", "name": "oval:org.mitre.oval:def:9408", "tags": [], "refsource": "OVAL"}, {"url": "http://www.securityfocus.com/archive/1/433928/30/5010/threaded", "name": "FLSA-2006:152898", "tags": [], "refsource": "FEDORA"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Format string vulnerability in the movemail utility in (1) Emacs 20.x, 21.3, and possibly other versions, and (2) XEmacs 21.4 and earlier, allows remote malicious POP3 servers to execute arbitrary code via crafted packets."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-0100", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "HIGH", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2005-02-07T05:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:gnu:emacs:21.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:gnu:emacs:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "20.0"}, {"cpe23Uri": "cpe:2.3:a:gnu:xemacs:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "21.4"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-19T15:31Z"}