Skip to content
Fencer Vulns
critical 9.8

CVE-2005-3120 in the critical feed json

Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certa…

published 2005-10-17 21 y ago modified 2026-06-16 4 mo ago also EUVD-2005-3120

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
23.3%
EPSS 23.3% chance of exploitation in 30 days, percentile 97%
public exploits
1
Exploit-DB

Summary

Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.

Patch / fix

  • lynx Debian 14, Debian 13, Debian 12 2.8.5-2sarge1

debian advisories DEBIAN-CVE-2005-3120

  • lynx RHEL 3 2.8.5-11.1
  • lynx RHEL 4 2.8.5-18.1

red hat advisories RHSA-2005:803

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2005-3120 updated

CAN-2005-3120 lynx buffer overflow

  • Red Hat Desktop version 3 lynx 2.8.5-11.1 Red Hat Enterprise Linux AS version 3 lynx 2.8.5-11.1 Red Hat Enterprise Linux AS version 4 lynx 2.8.5-18.1 Red Hat Enterprise Linux Desktop version 4 lynx 2.8.5-18.1 Red Hat Enterprise Linux ES version 3 lynx 2.8.5-11.1 Red Hat Enterprise Linux ES version 4 lynx 2.8.5-18.1
    +2 more products
    Red Hat Enterprise Linux WS version 3 lynx 2.8.5-11.1 Red Hat Enterprise Linux WS version 4 lynx 2.8.5-18.1
    fixed: vendor fix RHSA-2005:803

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-1256)
  2. Published

Exploit prediction

23.26% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-1256 Lynx 2.8.6dev.13 - Remote Buffer Overflow (PoC) dos, 2005-10-17

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-131 Incorrect Calculation of Buffer Size

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.