CVE-2005-3656

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 8.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-12-31 · updated 2026-06-16
Weakness: CWE-134

Description

Multiple format string vulnerabilities in logging functions in mod_auth_pgsql before 2.0.3, when used for user authentication against a PostgreSQL database, allows remote unauthenticated attackers to execute arbitrary code, as demonstrated via the username.

Affected products

Guiseppe Tanzilli And Matthias Eckermann Mod Auth Pgsql: through 2.0.3; 0.9.5, 0.9.6

References

http://secunia.com/advisories/18304
http://secunia.com/advisories/18321
http://secunia.com/advisories/18347
http://secunia.com/advisories/18348
http://secunia.com/advisories/18350
http://secunia.com/advisories/18397
http://secunia.com/advisories/18403
http://secunia.com/advisories/18463
http://secunia.com/advisories/18517
http://securitytracker.com/id?1015446
http://www.debian.de/security/2006/dsa-935

Get alerted when CVE-2005-3656 or the next vulnerability affects your stack