CVE-2005-0372

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in gftp before 2.0.18 for GTK+ allows remote malicious FTP servers to read arbitrary files via .. (dot dot) sequences in filenames returned from a LIST command.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000957Third Party Advisory
http://www.debian.org/security/2005/dsa-686Patch, Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200502-27.xmlPatch, Third Party Advisory, Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:050Broken Link
http://www.redhat.com/support/errata/RHSA-2005-410.htmlThird Party Advisory
http://www.securityfocus.com/advisories/8379Third Party Advisory, VDB Entry
http://www.securityfocus.com/advisories/8380Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/12539Patch, Third Party Advisory, VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A717Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9923Broken Link
http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000957Third Party Advisory
http://www.debian.org/security/2005/dsa-686Patch, Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200502-27.xmlPatch, Third Party Advisory, Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2005:050Broken Link
http://www.redhat.com/support/errata/RHSA-2005-410.htmlThird Party Advisory
http://www.securityfocus.com/advisories/8379Third Party Advisory, VDB Entry
http://www.securityfocus.com/advisories/8380Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/12539Patch, Third Party Advisory, VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A717Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9923Broken Link

Timeline

Published: May 2, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-03737.5Buffer overflow in digestmd5.c CVS release 1.170 (also referred to as digestmda5.c), as used in the DIGEST-MD5 SASL plugin for Cyrus-SASL bu CVE-2005-03744.3Cross-site scripting (XSS) vulnerability in Bitboard 2.5 and earlier allows remote attackers to inject arbitrary web script or HTML via an [CVE-2005-03755.0imageview.php in SGallery 1.01 allows remote attackers to obtain sensitive information via an HTTP request with (1) idalbum and (2) idimage CVE-2005-03767.5PHP remote file inclusion vulnerability in SGallery 1.01 allows local and possibly remote attackers to execute arbitrary PHP code by modifyi CVE-2005-03777.5SQL injection vulnerability in imageview.php for SGallery 1.01 allows remote attackers to execute arbitrary SQL commands via the (1) idalbum CVE-2005-03784.3Multiple cross-site scripting (XSS) vulnerabilities in Horde 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) g CVE-2005-03795.0Multiple directory traversal vulnerabilities in ZeroBoard 4.1pl5 and earlier allow remote attackers to read arbitrary files via a .. (dot do CVE-2005-03807.5Multiple PHP remote file inclusion vulnerabilities in (1) print_category.php, (2) login.php, (3) setup.php, (4) ask_password.php, or (5) err CVE-2005-03814.3Cross-site scripting (XSS) vulnerability in f.aspx in forumKIT 1.0 allows remote attackers to inject arbitrary web script or HTML via the me CVE-2005-03825.0Breed patch 1 and earlier allows remote attackers to cause a denial of service (application crash) via an empty UDP packet, which triggers a CVE-2005-03837.5Trend Micro Control Manager 3.0 Enterprise Edition allows remote attackers to gain privileges via a replay attack of the encrypted username CVE-2005-03845.0Unknown vulnerability in the PPP driver for the Linux kernel 2.6.8.1 allows remote attackers to cause a denial of service (kernel crash) via