CVE-2005-3887
Gadu-Gadu 7.20 does not properly handle MS-DOS device names in filenames, which allows remote...
Gadu-Gadu 7.20 does not properly handle MS-DOS device names in filenames, which allows remote attackers to (1) cause a denial of service (hang) via an image filename of AUX: sent twice (hang), or (2) write to the LPT1 port via a filename of "LPT1:".
Exploit likelihood
What each source reports
NVD Score used
Gadu-Gadu 7.20 does not properly handle MS-DOS device names in filenames, which allows remote attackers to (1) cause a denial of service (hang) via an image filename of AUX: sent twice (hang), or (2) write to the LPT1 port via a filename of "LPT1:".
- Record
CVE-2005-3887- CVSS 2.0
- 5.4 Medium
AV:N/AC:H/Au:N/C:N/I:N/A:C - Updated
- 2026-11-02
CVE List No score
Gadu-Gadu 7.20 does not properly handle MS-DOS device names in filenames, which allows remote attackers to (1) cause a denial of service (hang) via an image filename of AUX: sent twice (hang), or (2) write to the LPT1 port via a filename of "LPT1:".
- Record
CVE-2005-3887- Updated
- 2026-11-02
EUVDEUVD-2005-3882 No score
Gadu-Gadu 7.20 does not properly handle MS-DOS device names in filenames, which allows remote attackers to (1) cause a denial of service (hang) via an image filename of AUX: sent twice (hang), or (2) write to the LPT1 port via a filename of "LPT1:".
- Record
EUVD-2005-3882- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gfjf-95mx-j4gr No score
Gadu-Gadu 7.20 does not properly handle MS-DOS device names in filenames, which allows remote...
Gadu-Gadu 7.20 does not properly handle MS-DOS device names in filenames, which allows remote attackers to (1) cause a denial of service (hang) via an image filename of AUX: sent twice (hang), or (2) write to the LPT1 port via a filename of "LPT1:".
- Record
GHSA-gfjf-95mx-j4gr- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-3887 is a medium vulnerability (CVSS 5.4) in Gadu-gadu Instant Messenger, published November 29, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.89%, the 79th percentile. No source names a fixed version.
References
securityfocus.com/bid/15520
marc.info?l=bugtraq&m=113261573023912&w=2
osvdb.org/21015
secunia.com/advisories/17597
exchange.xforce.ibmcloud.com/vulnerabilities/23148
archives.neohapsis.com/archives/fulldisclosure/2005-11/0658.html
nvd.nist.gov/vuln/detail/CVE-2005-3887
github.com/advisories/GHSA-gfjf-95mx-j4gr