CVE-2005-3887: Gadu-Gadu Instant Messenger

Medium severity, CVSS 5.4. EPSS: 1.9% chance of exploitation in the next 30 days.

Gadu-Gadu 7.20 does not properly handle MS-DOS device names in filenames, which allows remote attackers to (1) cause a denial of service (hang) via an image filename of AUX: sent twice (hang), or (2) write to the LPT1 port via a filename of "LPT1:".

Affected products

• Gadu-Gadu Gadu-Gadu Instant Messenger: version 7.20 only

Published 2005-11-29. Last modified 2026-06-16.