CVE-2005-0373

Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in...

7.5 HighFix available

Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL but not in any official releases, allows remote attackers to execute arbitrary code.

Exploit likelihood

3.92%Down 2.6 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2005-0373
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2005-0373
Updated: 2026-11-02

EUVDEUVD-2005-0374 No score

Record: EUVD-2005-0374
Updated: 2026-11-03

GitHub AdvisoriesGHSA-48q4-vrg4-8rx4 No score

Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in...

Record: GHSA-48q4-vrg4-8rx4
Updated: 2026-11-02

OSV No score

Record: CVE-2005-0373
Updated: 2026-11-02

OSVDEBIAN-CVE-2005-0373 No score

Record: DEBIAN-CVE-2005-0373
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`cyrus-sasl2` Debian:12	before 2.1.19.dfsg1-0sarge2	2.1.19.dfsg1-0sarge2
`cyrus-sasl2` Debian:13	before 2.1.19.dfsg1-0sarge2	2.1.19.dfsg1-0sarge2
`cyrus-sasl2` Debian:14	before 2.1.19.dfsg1-0sarge2	2.1.19.dfsg1-0sarge2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-0373 is a high vulnerability (CVSS 7.5) in Cyrus Sasl, published October 7, 2004. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.92%, the 90th percentile. Fixed in cyrus-sasl2 2.1.19.dfsg1-0sarge2.

References

Show 5 moreShow less