CVE-2005-3123

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in GNUMP3D before 2.9.6 allows remote attackers to read arbitrary files via crafted sequences such as "/.//..//////././", which is collapsed into "/.././" after ".." and "//" sequences are removed.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.gnu.org/archive/html/gnump3d-users/2005-10/msg00013.htmlPatch
http://secunia.com/advisories/17351Exploit, Patch, Vendor Advisory
http://secunia.com/advisories/17559Vendor Advisory
http://securityreason.com/securityalert/127
http://securitytracker.com/id?1015118
http://www.debian.org/security/2005/dsa-877Patch, Vendor Advisory
http://www.novell.com/linux/security/advisories/2005_27_sr.html
http://www.novell.com/linux/security/advisories/2005_28_sr.html
http://www.osvdb.org/20360
http://www.securityfocus.com/bid/15228Patch
http://www.vupen.com/english/advisories/2005/2242
http://lists.gnu.org/archive/html/gnump3d-users/2005-10/msg00013.htmlPatch
http://secunia.com/advisories/17351Exploit, Patch, Vendor Advisory
http://secunia.com/advisories/17559Vendor Advisory
http://securityreason.com/securityalert/127
http://securitytracker.com/id?1015118
http://www.debian.org/security/2005/dsa-877Patch, Vendor Advisory
http://www.novell.com/linux/security/advisories/2005_27_sr.html
http://www.novell.com/linux/security/advisories/2005_28_sr.html
http://www.osvdb.org/20360
http://www.securityfocus.com/bid/15228Patch
http://www.vupen.com/english/advisories/2005/2242

Timeline

Published: Oct 30, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-31242.1syslogtocern in Acme thttpd before 2.23 allows local users to write arbitrary files via a symlink attack on a temporary file.CVE-2005-31261.9The (1) kantiword (kantiword.sh) and (2) gantiword (gantiword.sh) scripts in antiword 0.35 and earlier allow local users to overwrite arbitr CVE-2005-31274.3Cross-site scripting (XSS) vulnerability in index.php in lucidCMS 1.0.11 allows remote attackers to inject arbitrary web script or HTML via CVE-2005-31284.3Cross-site scripting (XSS) vulnerability in add.php in Address Add Plugin 1.9 and 2.0 for Squirrelmail allows remote attackers to inject arb CVE-2005-31295.1Cross-site request forgery (CSRF) vulnerability in Serendipity 0.8.4 and earlier allows remote attackers to perform unauthorized actions as CVE-2005-31307.5SQL injection vulnerability in lucidCMS 1.0.11 allows remote attackers to execute arbitrary SQL commands via the login field.CVE-2005-31314.3Multiple cross-site scripting (XSS) vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, CVE-2005-31325.0MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allows remote attackers to obtain sensitive information CVE-2005-31335.0Multiple directory traversal vulnerabilities in MERAK Mail Server 8.2.4r with Icewarp Web Mail 5.5.1, and possibly earlier versions, allows CVE-2005-31347.5Citrix Metaframe Presentation Server 3.0 and 4.0 allows remote attackers to bypass policy restrictions by downloading the launch.ica file an CVE-2005-31357.5Buffer overflow in Virtools Web Player 3.0.0.100 and earlier allows remote attackers to execute arbitrary code via a long filename.CVE-2005-31365.0Directory traversal vulnerability in Virtools Web Player 3.0.0.100 and earlier allows remote attackers to overwrite arbitrary files via a ..