VDB
CVE-2005-0490
CVE-2005-0490
PUBLISHED
CVSS 5.099999904632568 MEDIUM
Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.
EPSS 5.73% · 92.5th percentile
Risk Scores
CVSS 2.0
5.099999904632568
EPSS Score
5.73%
92.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| haxx | libcurl | 7.12.1 |
| haxx | curl | 7.12.1 |
Timeline
- Feb 21, 2005 CVE Published
- Feb 22, 2005 PoC Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Dec 19, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- May 26, 2023 EPSS Score
- Jul 18, 2023 EPSS Score
References
- oval:org.mitre.oval:def:10273 vdb
- curl-kerberos-bo(19423) vdb
- GLSA-200503-20 vendor-advisory
- RHSA-2005:340 vendor-advisory
- http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities technical
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:048 advisory
- http://www.securityfocus.com/bid/12616 technical
- http://marc.info/?l=full-disclosure&m=110959085507755&w=2 mailing_list
- http://www.securityfocus.com/bid/12615 technical
- https://nvd.nist.gov/vuln/detail/CVE-2005-0490 advisory
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000940 url
- http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities url
- http://www.novell.com/linux/security/advisories/2005_11_curl.html url