CVE-2005-2960

cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on...

2.1 LowFix available

cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.

Exploit likelihood

0.43%Down 1.1 points since Feb 4, 2022

What each source reports

NVD Score used 2.1

cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.

Record: CVE-2005-2960
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:N/I:P/A:N
Updated: 2026-11-02

CVE List No score

cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.

Record: CVE-2005-2960
Updated: 2026-11-02

EUVDEUVD-2005-2960 No score

cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.

Record: EUVD-2005-2960
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wgqp-qmfp-f6mf No score

cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on...

cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.

Record: GHSA-wgqp-qmfp-f6mf
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`cfengine` Debian:3.0	before 1.6.3-9woody1, plus listed versions 1.1.2-11.3.19-11.3.4-11.3.8-11.4.12-4 Show 7 moreShow less 1.4.14a-11.4.17-11.4.9-31.5.3-61.5.3-6.0.11.5.3-71.6.3-9	1.6.3-9woody1
`cfengine` Debian:3.1	before 1.6.5-1sarge1, plus listed versions 1.6.5-1	1.6.5-1sarge1
`cfengine2` Debian:3.1	before 2.1.14-1sarge1, plus listed versions 2.1.14-1	2.1.14-1sarge1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-2960 is a low vulnerability (CVSS 2.1) in Gnu Cfengine, published October 1, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in cfengine 1.6.3-9woody1.

References

Show 11 moreShow less