CVE-2004-0398
Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library ...
Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5 and earlier, as used by cadaver before 0.22, allows remote WebDAV servers to execute arbitrary code on the client.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5 and earlier, as used by cadaver before 0.22, allows remote WebDAV servers to execute arbitrary code on the client.
- Record
CVE-2004-0398- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5 and earlier, as used by cadaver before 0.22, allows remote WebDAV servers to execute arbitrary code on the client.
- Record
CVE-2004-0398- Updated
- 2026-11-02
EUVDEUVD-2004-0398 No score
Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5 and earlier, as used by cadaver before 0.22, allows remote WebDAV servers to execute arbitrary code on the client.
- Record
EUVD-2004-0398- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rx95-529p-86fc No score
Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library ...
Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5 and earlier, as used by cadaver before 0.22, allows remote WebDAV servers to execute arbitrary code on the client.
- Record
GHSA-rx95-529p-86fc- Weakness
- CWE-787
- Updated
- 2026-11-02
OSV No score
Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5 and earlier, as used by cadaver before 0.22, allows remote WebDAV servers to execute arbitrary code on the client.
- Record
CVE-2004-0398- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-0398 No score
Heap-based buffer overflow in the ne_rfc1036_parse date parsing function for the neon library (libneon) 0.24.5 and earlier, as used by cadaver before 0.22, allows remote WebDAV servers to execute arbitrary code on the client.
- Record
DEBIAN-CVE-2004-0398- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cadaverDebian:12 |
before 0.22.1-3 | 0.22.1-3 |
cadaverDebian:13 |
before 0.22.1-3 | 0.22.1-3 |
cadaverDebian:14 |
before 0.22.1-3 | 0.22.1-3 |
neonDebian:3.0 |
before 0.19.3-2woody5 | 0.19.3-2woody5 |
cadaverDebian:3.0 |
before 0.18.0-1woody3, plus listed versions 0.18.0-1 |
0.18.0-1woody3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2004-0398 is a high vulnerability (CVSS 7.5) in Webdav Cadaver, published May 19, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.01%, the 92nd percentile. Fixed in cadaver 0.22.1-3.
References
secunia.com/advisories/11638
osvdb.org/6302
archives.neohapsis.com/archives/fulldisclosure/2004-05/0982.html
marc.info?l=bugtraq&m=108500057108022&w=2
Show 15 moreShow less
security.gentoo.org/glsa/glsa-200405-13.xml
ciac.org/ciac/bulletins/o-148.shtml
mandriva.com/security/advisories?name=MDKSA-2004:049
securityfocus.com/bid/10385
debian.org/security/2004/dsa-506
bugzilla.fedora.us/show_bug.cgi?id=1552
exchange.xforce.ibmcloud.com/vulnerabilities/16192
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000841
redhat.com/support/errata/RHSA-2004-191.html
nvd.nist.gov/vuln/detail/CVE-2004-0398
github.com/advisories/GHSA-rx95-529p-86fc
security-tracker.debian.org/tracker/CVE-2004-0398