CVE-2005-2377
CVE-2005-2377 is a medium-severity vulnerability in Mandrakesoft Mandrake Linux with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.0)
- EPSS exploit prediction: 3% (83rd percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Mandrakesoft Mandrake Linux
- Published:
- Last modified:
Description
nss_ldap 181 to versions before 213, as used in Mandrake Corporate Server and Mandrake 10.0, and other operating systems, does not properly handle a SIGPIPE signal when sending a search request to an LDAP directory server, which might allow remote attackers to cause a denial of service (crond and other application crash) if they can cause an LDAP server to become unavailable. NOTE: it is not clear whether this attack scenario is sufficient to include this item in CVE.
Frequently asked questions
- What is CVE-2005-2377?
- nss_ldap 181 to versions before 213, as used in Mandrake Corporate Server and Mandrake 10.0, and other operating systems, does not properly handle a SIGPIPE signal when sending a search request to an LDAP directory server, which might allow remote attackers to cause a denial of service (crond and other application crash) if they can cause an LDAP server to become unavailable. NOTE: it is not clear whether this attack scenario is sufficient to include this item in CVE.
- How severe is CVE-2005-2377?
- CVE-2005-2377 has a CVSS 2.0 base score of 5.0, rated medium severity.
- Is CVE-2005-2377 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (83rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2005-2377?
- CVE-2005-2377 primarily affects Mandrakesoft Mandrake Linux. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2005-2377?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2005-2377 published?
- CVE-2005-2377 was published on 2005-07-26 and last updated on 2026-06-16.
References
- http://qa.mandriva.com/show_bug.cgi?id=13271
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:121
- https://exchange.xforce.ibmcloud.com/vulnerabilities/40501
Affected products (2)
- cpe:2.3:o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:mandrakesoft:mandrake_linux_corporate_server:*:*:*:*:*:*:*:*
More vulnerabilities in Mandrakesoft Mandrake Linux
- CVE-2005-3625 — Critical (CVSS 10.0): Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows…
- CVE-2004-1187 — Critical (CVSS 10.0): Heap-based buffer overflow in the pnm_get_chunk function for xine 0.99.2, and other packages such as MPlayer that use…
- CVE-2004-1188 — Critical (CVSS 10.0): The pnm_get_chunk function in xine 0.99.2 and earlier, and other packages such as MPlayer that use the same code, does…
- CVE-2004-0461 — Critical (CVSS 10.0): The DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13, when compiled in environments that do not provide the…
- CVE-2004-0460 — Critical (CVSS 10.0): Buffer overflow in the logging capability for the DHCP daemon (DHCPD) for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows…
- CVE-2004-0386 — Critical (CVSS 10.0): Buffer overflow in the HTTP parser for MPlayer 1.0pre3 and earlier, 0.90, and 0.91 allows remote attackers to execute…