CVE-2005-2878

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 14.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-09-13 · updated 2026-06-16

Description

Format string vulnerability in search.c in the imap4d server in GNU Mailutils 0.6 allows remote authenticated users to execute arbitrary code via format string specifiers in the SEARCH command.

Affected products

GNU Mailutils: 0.6

References

http://marc.info/?l=bugtraq&m=112785181316043&w=2
http://savannah.gnu.org/patch/index.php?func=detailitem&item_id=4407
http://secunia.com/advisories/16783
http://secunia.com/advisories/17020
http://www.debian.org/security/2005/dsa-841
http://www.gentoo.org/security/en/glsa/glsa-200509-10.xml
http://www.idefense.com/application/poi/display?id=303&type=vulnerabilities&flashstatus=true
http://www.rosiello.org/archivio/imap4d_FreeBSD_exploit.c
http://www.securityfocus.com/bid/14794
http://marc.info/?l=bugtraq&m=112785181316043&w=2
http://savannah.gnu.org/patch/index.php?func=detailitem&item_id=4407
http://secunia.com/advisories/16783

Get alerted when CVE-2005-2878 or the next vulnerability affects your stack