CVE catalog

CVE-2005-2772

gopher: CVE-2005-2772

[CVE catalog]

Severity
Critical
Published
Source
[NVD] · [CVE record]
EPSS
10.04% · Oct 25, 2026

Multiple stack-based buffer overflows in University of Minnesota gopher client 3.0.9 allow remote malicious servers to execute arbitrary code via (1) a long "+VIEWS:" reply, which is not properly handled in the VIfromLine function, and (2) certain arguments when launching third party programs such as a web browser from a web link, which is not properly handled in the FIOgetargv function.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangophersid3.0.19+nmu1fixed
Debiangopherforky3.0.19+nmu1fixed
Debiangophertrixie3.0.18fixed
Debiangopherbookworm3.0.17.3+nmu1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangophersourcesid3.0.11highNot reported[327722]
Debiangophersourceforky3.0.11highNot reported[327722]
Debiangophersourcetrixie3.0.11highNot reported[327722]
Debiangophersourcebookworm3.0.11highNot reported[327722]

[Debian bug #327722]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [gopher]Fixed

    Source package: [gopher]

    Details (2)

    • 3.0.17.3+nmu1+b1 · amd64 · bookworm

      Fixed · Fixed: 3.0.11

      dsa · gopher · debian · bookworm; dsa · gopher · debian · 12

    • 3.0.17.3+nmu1+b1 · arm64 · bookworm

      Fixed · Fixed: 3.0.11

      dsa · gopher · debian · bookworm; dsa · gopher · debian · 12

[Debian 13 (Trixie)]

  • [gopher]Fixed
    Details (2)

    • 3.0.18 · amd64 · trixie

      Fixed · Fixed: 3.0.11

      dsa · gopher · debian · 13

    • 3.0.18 · arm64 · trixie

      Fixed · Fixed: 3.0.11

      dsa · gopher · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]