CVE-2005-3120
9.8 · CRITICALOverview
CVE-2005-3120 is a critical-severity vulnerability affecting invisible-island lynx. It was published on October 17, 2005 and has a CVSS 3.1 base score of 9.8 (CRITICAL).
This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
Technical Description
Stack-based buffer overflow in the HTrjis function in Lynx 2.8.6 and earlier allows remote NNTP servers to execute arbitrary code via certain article headers containing Asian characters that cause Lynx to add extra escape (ESC) characters.
Remediation
Check the references section for vendor advisories and patches from invisible-island. Update lynx to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
Affected Products
| Vendor | Product | Versions | Status |
|---|---|---|---|
| invisible-island | lynx | 0 | Affected |
References
Frequently Asked Questions
What is CVE-2005-3120?
CVE-2005-3120 is a critical-severity vulnerability affecting invisible-island lynx. It was published on October 17, 2005 and has a CVSS 3.1 base score of 9.8 (CRITICAL).
How severe is CVE-2005-3120?
This vulnerability has a CVSS 3.1 base score of 9.8, rated CRITICAL. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.
How do I fix or remediate CVE-2005-3120?
Check the references section for vendor advisories and patches from invisible-island. Update lynx to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.
How can CyberStrike help with CVE-2005-3120?
CyberStrike's AI-powered security agents can automatically detect CVE-2005-3120 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.
How CyberStrike Helps
AI agents map your attack surface to find vulnerabilities like this one.
Automated penetration testing that runs continuously, not just quarterly.
AI-driven PR review catches vulnerable dependencies before they ship.
Browser-based exploitation validates findings with real proof-of-concept.
Related CRITICAL CVEs from 2005
View all →Integer overflow in camel-lock-helper in Evolution 2.0.2 and earlier allows local users or remote ma
CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash
Arkeia Network Backup Client 5.x contains hard-coded credentials that effectively serve as a back do
Integer overflow in the readpgm function in pnm.c for GOCR 0.40, when using the netpbm library, allo
Integer underflow in the Lists_MakeMask() function in lists.c in ngIRCd before 0.8.2 allows remote a
The file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all lowe
Integer overflow in the stralloc_readyplus function in qmail, when running on 64 bit platforms with
BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an a
Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier a
Buffer overflow in the AIM and ICQ module in Gaim before 1.5.0 allows remote attackers to cause a de
HP OpenView Network Node Manager 6.2 through 7.50 allows remote attackers to execute arbitrary comma
admin_news.php in Archilles Newsworld up to 1.3.0 allows attackers to bypass authentication by obtai