CVE-2005-3254
The CGIwrap program before 3.9 on Debian GNU/Linux uses an incorrect minimum value of 100 for a...
CVE-2005-3254 is a high vulnerability (CVSS 10.0) in Nathan Neulinger Cgiwrap, published August 28, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.65%, the 85th percentile. Fixed in cgiwrap 3.9-3.0etch1.
The CGIwrap program before 3.9 on Debian GNU/Linux uses an incorrect minimum value of 100 for a UID to determine whether it can perform a seteuid operation, which could allow attackers to execute code as other system UIDs that are greater than the minimum value, which should be 1000 on Debian systems.
Exploit likelihood
What each source reports
NVD Score used
The CGIwrap program before 3.9 on Debian GNU/Linux uses an incorrect minimum value of 100 for a UID to determine whether it can perform a seteuid operation, which could allow attackers to execute code as other system UIDs that are greater than the minimum value, which should be 1000 on Debian systems.
- Record
CVE-2005-3254- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
The CGIwrap program before 3.9 on Debian GNU/Linux uses an incorrect minimum value of 100 for a UID to determine whether it can perform a seteuid operation, which could allow attackers to execute code as other system UIDs that are greater than the minimum value, which should be 1000 on Debian systems.
- Record
CVE-2005-3254- Updated
- 2026-11-02
EUVDEUVD-2005-3253 No score
The CGIwrap program before 3.9 on Debian GNU/Linux uses an incorrect minimum value of 100 for a UID to determine whether it can perform a seteuid operation, which could allow attackers to execute code as other system UIDs that are greater than the minimum value, which should be 1000 on Debian systems.
- Record
EUVD-2005-3253- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gf72-98fx-66p4 No score
The CGIwrap program before 3.9 on Debian GNU/Linux uses an incorrect minimum value of 100 for a...
The CGIwrap program before 3.9 on Debian GNU/Linux uses an incorrect minimum value of 100 for a UID to determine whether it can perform a seteuid operation, which could allow attackers to execute code as other system UIDs that are greater than the minimum value, which should be 1000 on Debian systems.
- Record
GHSA-gf72-98fx-66p4- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cgiwrapDebian:4.0 |
before 3.9-3.0etch1 | 3.9-3.0etch1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |