CVE-2004-0996: Cscope

Low severity, CVSS 2.1. EPSS: 1.1% chance of exploitation in the next 30 days.

main.c in cscope 15-4 and 15-5 creates temporary files with predictable filenames, which allows local users to overwrite arbitrary files via a symlink attack.

Affected products

• Cscope Cscope: version 13.0 only; version 15.1 only; version 15.3 only; version 15.4 only; version 15.5 only
• Debian Debian Linux: version 3.0 only
• Gentoo Linux: any version
• Sco Unixware: version 7.1.1 only; version 7.1.3 only; version 7.1.4 only

Published 2005-01-10. Last modified 2026-06-16.