CVE-2005-2972

MediumCVSS 5.1/10Last modified Jun 16, 2026

Description

Multiple stack-based buffer overflows in the RTF import feature in AbiWord before 2.2.11 allow user-assisted attackers to execute arbitrary code via an RTF file with long identifiers, which are not properly handled in the (1) ParseLevelText, (2) getCharsInsideBrace, (3) HandleLists, (4) or (5) HandleAbiLists functions in ie_imp_RTF.cpp, a different vulnerability than CVE-2005-2964.

Metrics

CVSS 2.0 5.1/10AV:N/AC:H/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://scary.beasts.org/security/CESA-2005-006.txtExploit, Vendor Advisory
http://secunia.com/advisories/17199Vendor Advisory
http://secunia.com/advisories/17200Vendor Advisory
http://secunia.com/advisories/17213Vendor Advisory
http://secunia.com/advisories/17264Vendor Advisory
http://secunia.com/advisories/17551Vendor Advisory
http://www.abisource.com/changelogs/2.2.11.phtml
http://www.debian.org/security/2005/dsa-894
http://www.gentoo.org/security/en/glsa/glsa-200510-17.xmlPatch, Vendor Advisory
http://www.mail-archive.com/debian-bugs-rc%40lists.debian.org/msg28251.html
http://www.osvdb.org/20015
http://www.securityfocus.com/bid/15096
http://www.vupen.com/english/advisories/2005/2086Vendor Advisory
https://usn.ubuntu.com/203-1/
http://scary.beasts.org/security/CESA-2005-006.txtExploit, Vendor Advisory
http://secunia.com/advisories/17199Vendor Advisory
http://secunia.com/advisories/17200Vendor Advisory
http://secunia.com/advisories/17213Vendor Advisory
http://secunia.com/advisories/17264Vendor Advisory
http://secunia.com/advisories/17551Vendor Advisory
http://www.abisource.com/changelogs/2.2.11.phtml
http://www.debian.org/security/2005/dsa-894
http://www.gentoo.org/security/en/glsa/glsa-200510-17.xmlPatch, Vendor Advisory
http://www.mail-archive.com/debian-bugs-rc%40lists.debian.org/msg28251.html
http://www.osvdb.org/20015
http://www.securityfocus.com/bid/15096
http://www.vupen.com/english/advisories/2005/2086Vendor Advisory
https://usn.ubuntu.com/203-1/

Timeline

Published: Oct 23, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-29732.1The udp_v6_get_port function in udp.c in Linux 2.6 before 2.6.14-rc5, when running IPv6, allows local users to cause a denial of service (in CVE-2005-29742.6libungif library before 4.1.0 allows attackers to cause a denial of service via a crafted GIF file that triggers a null dereference.CVE-2005-29757.8io-xpm.c in the gdk-pixbuf XPM image rendering library in GTK+ before 2.8.7 allows attackers to cause a denial of service (infinite loop) vi CVE-2005-29767.5Integer overflow in io-xpm.c in gdk-pixbuf 0.22.0 in GTK+ before 2.8.7 allows attackers to cause a denial of service (crash) or execute arbi CVE-2005-29772.1The SELinux version of PAM before 0.78 r3 allows local users to perform brute force password guessing attacks via unix_chkpwd, which does no CVE-2005-29787.5pnmtopng in netpbm before 10.25, when using the -trans option, uses uninitialized size and index variables when converting Portable Anymap (CVE-2005-29797.5SQL injection vulnerability in index.php in phpoutsourcing Noah's classifieds allows remote attackers to execute arbitrary SQL commands via CVE-2005-29804.3Cross-site scripting (XSS) vulnerability in index.php in phpoutsourcing Noah's classifieds 1.3 allows remote attackers to inject arbitrary w CVE-2005-29814.3Cross-site scripting (XSS) vulnerability in Orion 1.3.8 and 1.4.5 allows remote attackers to inject arbitrary web script or HTML via the URL CVE-2005-29824.3Cross-site scripting (XSS) vulnerability in CompaqHTTPServer 2.1 allows remote attackers to inject arbitrary web script or HTML via the URL,CVE-2005-29837.5SQL injection vulnerability in Oracle Reports that use Lexical References allows remote attackers to execute arbitrary SQL commands via the CVE-2005-29844.6Avocent CCM console server running firmware 2.1 CCM4850 allows remote authenticated attackers to bypass port restrictions by connecting to t