CVE-2005-2960
cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on...
CVE-2005-2960 is a low vulnerability (CVSS 2.1) in Gnu Cfengine, published October 1, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. No source names a fixed version.
- Severity
- 2.1 LowCVSS 2.0, NVD
- Exploit chance
- 0.43%EPSS, 37th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cfengineDebian:3.0 From an advisory covering 2 CVEs | before 1.6.3-9woody1, plus listed versions 1.1.2-11.3.19-11.3.4-11.3.8-11.4.12-4 Show 7 moreShow less1.4.14a-11.4.17-11.4.9-31.5.3-61.5.3-6.0.11.5.3-71.6.3-9 | 1.6.3-9woody1 |
cfengineDebian:3.1 From an advisory covering 2 CVEs | before 1.6.5-1sarge1, plus listed versions 1.6.5-1 | 1.6.5-1sarge1 |
cfengine2Debian:3.1 From an advisory covering 2 CVEs | before 2.1.14-1sarge1, plus listed versions 2.1.14-1 | 2.1.14-1sarge1 |
What each source reports
NVD Score used
cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.
- Record
CVE-2005-2960- CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE ListNo score
cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.
- Record
CVE-2005-2960- Updated
- 2026-11-02
EUVDEUVD-2005-2960No score
cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.
- Record
EUVD-2005-2960- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wgqp-qmfp-f6mfNo score
cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on...
cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.
- Record
GHSA-wgqp-qmfp-f6mf- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
bugs.gentoo.org/show_bug.cgi?id=107871
secunia.com/advisories/17040
exchange.xforce.ibmcloud.com/vulnerabilities/22489
securityfocus.com/bid/14994
debian.org/security/2005/dsa-836
ubuntu.com/usn/usn-198-1
Show 11 moreShow less
groups.google.com/group/gnu.cfengine.help/browse_thread/thread/fc25e7d98f8ba401/38151ed821803be0
mandriva.com/security/advisories?name=MDKSA-2005:184
novell.com/linux/security/advisories/2005_23_sr.html
nvd.nist.gov/vuln/detail/CVE-2005-2960
github.com/advisories/GHSA-wgqp-qmfp-f6mf