PT-2005-3973 · Alibaba · Weex

Ulf Harnhammar · Published 2005-10-05 · Updated 2008-09-05 · CVE-2005-3150

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Weex versions 2.6.1 through 2.6.1.5

Description The issue allows remote FTP servers to execute arbitrary code via format strings in filenames. This is due to a format string vulnerability in the Log Flush function.

Recommendations For versions 2.6.1 through 2.6.1.5, consider disabling the Log Flush function until a patch is available to prevent remote code execution.

Fix

Related Identifiers

CVE-2005-3150

DSA-855-1

Affected Products

Weex

References · 11

• http://debian.org/security/2005/dsa-855 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2005-3150 · Vendor Advisory
• http://gentoo.org/security/en/glsa/glsa-200510-09.xml · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2005-3150 · Vendor Advisory
• http://secunia.com/advisories/17028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-3150 · Security Note
• http://freebsd.org/cgi/query-pr.cgi?pr=ports/86833 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2005-3150 · Vendor Advisory
• http://secunia.com/advisories/17081 · Note
• http://secunia.com/advisories/17112 · Note
• http://securityfocus.com/bid/14999 · Note