CVE-2005-1523
Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions...
Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string specifiers in the command tag for IMAP commands.
Exploit likelihood
What each source reports
NVD Score used
Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string specifiers in the command tag for IMAP commands.
- Record
CVE-2005-1523- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string specifiers in the command tag for IMAP commands.
- Record
CVE-2005-1523- Updated
- 2026-11-02
EUVDEUVD-2005-1526No score
Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string specifiers in the command tag for IMAP commands.
- Record
EUVD-2005-1526- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xwqj-7mqr-967jNo score
Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions...
Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string specifiers in the command tag for IMAP commands.
- Record
GHSA-xwqj-7mqr-967j- Updated
- 2026-11-02
OSVNo score
Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string specifiers in the command tag for IMAP commands.
- Record
CVE-2005-1523- Updated
- 2026-11-02
OSVDEBIAN-CVE-2005-1523No score
Format string vulnerability in imap4d server in GNU Mailutils 0.5 and 0.6, and other versions before 0.6.90, allows remote attackers to execute arbitrary code via format string specifiers in the command tag for IMAP commands.
- Record
DEBIAN-CVE-2005-1523- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mailutilsDebian:12 | before 1:0.6.1-3 | 1:0.6.1-3 |
mailutilsDebian:13 | before 1:0.6.1-3 | 1:0.6.1-3 |
mailutilsDebian:14 | before 1:0.6.1-3 | 1:0.6.1-3 |
mailutilsDebian:3.0 From an advisory covering 4 CVEs | before 20020409-1woody2, plus listed versions 20020409-120020409-1woody1 | 20020409-1woody2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | GNU Mailutils imap4d 0.6 - Remote Format String | 2005-08-01 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-1523 is a high vulnerability (CVSS 7.5) in Gnu Mailutils, published May 26, 2005. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.78%, the 95th percentile. Fixed in mailutils 1:0.6.1-3.
References
securitytracker.com/id?1014052
idefense.com/application/poi/display?id=246&type=vulnerabilities
secunia.com/advisories/15442
debian.org/security/2005/dsa-732
securityfocus.com/bid/13764
nvd.nist.gov/vuln/detail/CVE-2005-1523
github.com/advisories/GHSA-xwqj-7mqr-967j
security-tracker.debian.org/tracker/CVE-2005-1523