{"id":"CVE-2005-3120","aliases":["DEBIAN-CVE-2005-3120","DSA-1085-1","DSA-874-1","DSA-876-1","EUVD-2005-3120","GHSA-c6vg-33v6-g8vm","RHSA-2005:803"],"status":"published","title":"Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP...","description":"Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.23257,"percentile":0.97788,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-131"],"published":"2005-10-17T04:00:00Z","modified":"2026-10-23T04:00:41Z","exploits":[{"source":"exploitdb","id":"EDB-1256","title":"Lynx 2.8.6dev.13 - Remote Buffer Overflow (PoC)","type":"dos","platform":"multiple","date":"2005-10-17","verified":true,"url":"https://www.exploit-db.com/exploits/1256"}],"fixes":[{"ecosystem":"Debian:12","package":"lynx","fixed_in":["2.8.5-2sarge1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lynx","fixed_in":["2.8.5-2sarge1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lynx","fixed_in":["2.8.5-2sarge1"],"sources":["osv"]},{"ecosystem":"Debian:3.0","package":"lynx-cur","fixed_in":["2.8.5-2.5woody1"],"sources":["osv"]},{"ecosystem":"Debian:3.1","package":"lynx-cur","fixed_in":["2.8.6-9sarge1"],"sources":["osv"]},{"ecosystem":"Debian:3.0","package":"lynx","fixed_in":["2.8.4.1b-3.3","2.8.4.1b-3.2"],"sources":["osv"]},{"ecosystem":"Debian:3.1","package":"lynx","fixed_in":["2.8.5-2sarge1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"lynx","fixed_in":["0:2.8.5-11.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"lynx-debuginfo","fixed_in":["0:2.8.5-11.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"lynx","fixed_in":["0:2.8.5-11.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"lynx-debuginfo","fixed_in":["0:2.8.5-11.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"lynx","fixed_in":["0:2.8.5-11.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"lynx-debuginfo","fixed_in":["0:2.8.5-11.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"lynx","fixed_in":["0:2.8.5-11.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"lynx-debuginfo","fixed_in":["0:2.8.5-11.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"lynx","fixed_in":["0:2.8.5-18.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"lynx-debuginfo","fixed_in":["0:2.8.5-18.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"lynx","fixed_in":["0:2.8.5-18.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"lynx-debuginfo","fixed_in":["0:2.8.5-18.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"lynx","fixed_in":["0:2.8.5-18.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"lynx-debuginfo","fixed_in":["0:2.8.5-18.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"lynx","fixed_in":["0:2.8.5-18.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"lynx-debuginfo","fixed_in":["0:2.8.5-18.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-2sarge1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-2sarge1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-2sarge1"}]}]},{"source":"osv","ecosystem":"Debian:3.0","package":"lynx-cur","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-2.5woody1"}]}],"versions":["2.8.5-2.5"]},{"source":"osv","ecosystem":"Debian:3.1","package":"lynx-cur","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.6-9sarge1"}]}],"versions":["2.8.6-9"]},{"source":"osv","ecosystem":"Debian:3.0","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4.1b-3.3"}]}],"versions":["2.8.4.1b-3.2"]},{"source":"osv","ecosystem":"Debian:3.1","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-2sarge1"}]}],"versions":["2.8.5-2"]},{"source":"osv","ecosystem":"Debian:3.0","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.4.1b-3.2"}]}]},{"source":"osv","ecosystem":"Debian:3.1","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.5-2sarge1"}]}],"versions":["2.8.5-2"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-11.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"lynx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-11.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-11.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"lynx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-11.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-11.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"lynx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-11.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-11.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"lynx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-11.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"lynx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"lynx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"lynx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"lynx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"lynx-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.8.5-18.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"invisible-island","product":"lynx"}],"references":[{"url":"http://securitytracker.com/id?1015065","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://secunia.com/advisories/18376","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/17216","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/17480","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html","tags":["vendor-advisory","x_refsource_TRUSTIX","x_transferred","Broken Link","web"]},{"url":"http://slackware.com/security/viewer.php?l=slackware-security\u0026y=2005\u0026m=slackware-security.423056","tags":["vendor-advisory","x_refsource_SLACKWARE","x_transferred","Broken Link","web"]},{"url":"http://www.openpkg.org/security/OpenPKG-SA-2005.026-lynx.html","tags":["vendor-advisory","x_refsource_OPENPKG","x_transferred","Broken Link","web"]},{"url":"ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.47/SCOSA-2005.47.txt","tags":["vendor-advisory","x_refsource_SCO","x_transferred","Broken Link","web"]},{"url":"http://lists.grok.org.uk/pipermail/full-disclosure/2005-October/038019.html","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Broken Link","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"http://www.securityfocus.com/archive/1/435689/30/4740/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://secunia.com/advisories/17444","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://www.debian.org/security/2006/dsa-1085","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200510-15.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/18584","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/17238","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://www.novell.com/linux/security/advisories/2005_25_sr.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/17150","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2005:186","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/17248","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=170253","tags":["x_refsource_MISC","x_transferred","Issue Tracking","report"]},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2006-010.htm","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/archive/1/419763/100/0/threaded","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"http://secunia.com/advisories/17360","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/17445","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://www.securityfocus.com/bid/15117","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://usn.ubuntu.com/206-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Broken Link","web"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9257","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","Broken Link","web"]},{"url":"http://www.redhat.com/support/errata/RHSA-2005-803.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Broken Link","Vendor Advisory","advisory","web"]},{"url":"http://secunia.com/advisories/17231","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/17230","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/17340","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"http://secunia.com/advisories/20383","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","advisory"]},{"url":"ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.7/SCOSA-2006.7.txt","tags":["vendor-advisory","x_refsource_SCO","x_transferred","Broken Link","web"]},{"url":"http://www.debian.org/security/2005/dsa-874","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.debian.org/security/2005/dsa-876","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-3120","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c6vg-33v6-g8vm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2005-3120","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2005:803","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=170253","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_803.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2005-3120","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-3120","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2005-3120","description":"Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.","status":"published","published":"2005-10-17T04:00:00Z","modified":"2024-08-07T23:01:58.162Z","updated_at":"2026-11-02T14:33:38.906611Z"}],"euvd":[{"id":"EUVD-2005-3120","description":"Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.","status":"published","published":"2005-10-17T04:00:00Z","modified":"2024-08-07T23:01:58Z","updated_at":"2026-11-03T01:15:28.248402Z"}],"ghsa":[{"id":"GHSA-c6vg-33v6-g8vm","title":"Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP...","description":"Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.","status":"published","published":"2022-05-03T03:14:24Z","modified":"2023-02-01T05:01:13Z","updated_at":"2026-11-02T14:49:41.640503Z"}],"nvd":[{"id":"CVE-2005-3120","description":"Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.","status":"published","published":"2005-10-17T20:06:00Z","modified":"2026-06-16T22:16:17.433Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-131"],"updated_at":"2026-11-02T14:00:56.902692Z"}],"osv":[{"id":"CVE-2005-3120","description":"Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.","status":"published","published":"2005-10-17T20:06:00Z","modified":"2026-04-10T03:37:14.447922Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:43:56.581247Z"},{"id":"DEBIAN-CVE-2005-3120","description":"Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.","status":"published","published":"2005-10-17T20:06:00Z","modified":"2026-10-23T04:00:41.830702473Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:22.831407Z"},{"id":"DSA-1085-1","title":"lynx-cur - several vulnerabilities","status":"published","published":"2006-06-01T00:00:00Z","modified":"2026-03-09T01:01:21.136391Z","updated_at":"2026-11-02T15:46:14.285228Z"},{"id":"DSA-874-1","title":"lynx - buffer overflow","status":"published","published":"2005-10-27T00:00:00Z","modified":"2026-03-09T02:09:45.039878Z","updated_at":"2026-11-02T15:46:18.716547Z"},{"id":"DSA-876-1","title":"lynx-ssl - buffer overflow","status":"published","published":"2005-10-27T00:00:00Z","modified":"2026-03-09T02:09:38.498221Z","updated_at":"2026-11-02T15:46:18.716547Z"},{"id":"RHSA-2005:803","title":"Red Hat Security Advisory: lynx security update","status":"published","published":"2024-09-15T15:51:38Z","modified":"2026-06-26T10:03:52Z","updated_at":"2026-11-02T15:52:59.135214Z"}]}}