GNU Cfengine vulnerabilities
6 CVEs affecting GNU Cfengine, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2005-3137, published 2005-10-05.
More from GNU.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2004-1701, published 2004-08-09. High severity, CVSS 10.0. EPSS: 19.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitrary code via a long SAUTH command during RSA…
- CVE-2003-0849, published 2003-11-17. High severity, CVSS 7.5. EPSS: 10.9% chance of exploitation in the next 30 days. Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which is trusted by the ReceiveTransaction…
- CVE-2000-0947, published 2000-12-19. High severity, CVSS 10.0. EPSS: 2.5% chance of exploitation in the next 30 days. Format string vulnerability in cfd daemon in GNU CFEngine before 1.6.0a11 allows attackers to execute arbitrary commands via format characters in the CAUTH command.
- CVE-2004-1702, published 2004-08-09. Medium severity, CVSS 5.0. EPSS: 2.4% chance of exploitation in the next 30 days. The AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 does not properly check the return value of the ReceiveTransaction function, which leads to a failed malloc call and…
- CVE-2005-2960, published 2005-10-05. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.
- CVE-2005-3137, published 2005-10-05. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. The (1) cfmailfilter and (2) cfcron.in files for cfengine 1.6.5 allow local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2005-2960.