Vulnerability in Invisible-island Lynx
CVE-2005-3120
Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.
EPSS: 0.233 (97.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Invisible-island Lynx
- Debian Debian_linux — versions 3.0, 3.1
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@debian.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK, Broken Link)
- security@debian.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- security@debian.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- security@debian.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- security@debian.org (vendor-advisory, x_refsource_TRUSTIX, Broken Link)
- security@debian.org (vendor-advisory, Broken Link, x_refsource_SLACKWARE)
- security@debian.org (vendor-advisory, x_refsource_OPENPKG, Broken Link)
- security@debian.org (Broken Link, Vendor Advisory, mailing-list, Patch, x_refsource_FULLDISC)
- security@debian.org (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory, Broken Link)
- security@debian.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
Frequently asked questions
- What is CVE-2005-3120?
- CVE-2005-3120 is a critical-severity vulnerability in Invisible-island Lynx, classified under Incorrect Calculation of Buffer Size. CVSS score: 9.8/10. Published 2005-10-17.
- How severe is CVE-2005-3120?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2005-3120 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.