{"id":"CVE-2005-3120","url":"https://www.cyber-defence.io/tools/cve/CVE-2005-3120","generatedAt":"2026-10-27T17:38:01.042Z","title":"Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.","description":"Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.","published":"2005-10-17T20:06:00.000Z","lastModified":"2026-06-16T22:16:17.000Z","status":"Modified","sourceIdentifier":"security@debian.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-131"],"affected":["invisible-island/lynx","debian/debian linux"],"epss":{"score":0.23257,"percentile":0.97758,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":1,"verified":true,"firstPublished":"2005-10-17","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":1256,"kind":"exploit","title":"Lynx 2.8.6dev.13 - Remote Buffer Overflow (PoC)","url":"https://www.exploit-db.com/exploits/1256","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/dos/1256.pl","file":"exploits/multiple/dos/1256.pl","published":"2005-10-17","added":"2005-10-16","updated":"2016-06-07","author":"Ulf Harnhammar","type":"dos","platform":"multiple","port":null,"verified":true,"codes":["OSVDB-20019","CVE-2005-3120"],"tags":null,"aliases":null,"applicationUrl":"http://www.exploit-db.comlynx2.8.5.tar.bz2","screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 23.3%, higher than 98% of all known CVEs. Patch or mitigate before the next change window."},"changes":[],"references":[{"url":"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.7/SCOSA-2006.7.txt","tags":["Broken Link"],"source":"security@debian.org"},{"url":"ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.47/SCOSA-2005.47.txt","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html","tags":["Broken Link","Patch","Vendor Advisory"],"source":"security@debian.org"},{"url":"http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/17150","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/17216","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/17230","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/17231","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/17238","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/17248","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/17340","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/17360","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/17444","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/17445","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/17480","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/18376","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/18584","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://secunia.com/advisories/20383","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://securitytracker.com/id?1015065","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"security@debian.org"},{"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.423056","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2006-010.htm","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://www.debian.org/security/2005/dsa-874","tags":["Mailing List","Third Party Advisory"],"source":"security@debian.org"},{"url":"http://www.debian.org/security/2005/dsa-876","tags":["Mailing List","Third Party Advisory"],"source":"security@debian.org"},{"url":"http://www.debian.org/security/2006/dsa-1085","tags":["Mailing List","Third Party Advisory"],"source":"security@debian.org"},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200510-15.xml","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2005:186","tags":["Third Party Advisory"],"source":"security@debian.org"},{"url":"http://www.novell.com/linux/security/advisories/2005_25_sr.html","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://www.openpkg.org/security/OpenPKG-SA-2005.026-lynx.html","tags":["Broken Link"],"source":"security@debian.org"},{"url":"http://www.redhat.com/support/errata/RHSA-2005-803.html","tags":["Broken Link","Vendor Advisory"],"source":"security@debian.org"},{"url":"http://www.securityfocus.com/archive/1/419763/100/0/threaded","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"security@debian.org"},{"url":"http://www.securityfocus.com/archive/1/435689/30/4740/threaded","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"security@debian.org"},{"url":"http://www.securityfocus.com/bid/15117","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"security@debian.org"},{"url":"https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=170253","tags":["Issue Tracking"],"source":"security@debian.org"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9257","tags":["Broken Link"],"source":"security@debian.org"},{"url":"https://usn.ubuntu.com/206-1/","tags":["Broken Link"],"source":"security@debian.org"},{"url":"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.7/SCOSA-2006.7.txt","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.47/SCOSA-2005.47.txt","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html","tags":["Broken Link","Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/17150","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/17216","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/17230","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/17231","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/17238","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/17248","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/17340","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/17360","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/17444","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/17445","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/17480","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/18376","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/18584","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://secunia.com/advisories/20383","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://securitytracker.com/id?1015065","tags":["Broken Link","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.423056","tags":["Broken Link"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2006-010.htm","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2005/dsa-874","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2005/dsa-876","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.debian.org/security/2006/dsa-1085","tags":["Mailing List","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200510-15.xml","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2005-3120","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}