CVE-2004-0005: gaim_project gaim Off-by-one Error

Vulnerability summary

CVE-2004-0005 is a critical (CVSS 9.8) Off-by-one Error vulnerability in gaim_project gaim. EPSS estimates a 11.21% chance of exploitation in the next 30 days, higher than 95.9% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 03-02-2004
   PublishedVulnerability first disclosed.
2. 08-08-2024
   Last modifiedVulnerability information updated.

Description

Multiple buffer overflows in Gaim 0.75 allow remote attackers to cause a denial of service and possibly execute arbitrary code via (1) octal encoding in yahoo_decode that causes a null byte to be written beyond the buffer, (2) octal encoding in yahoo_decode that causes a pointer to reference memory beyond the terminating null byte, (3) a quoted printable string to the gaim_quotedp_decode MIME decoder that causes a null byte to be written beyond the buffer, and (4) quoted printable encoding in gaim_quotedp_decode that causes a pointer to reference memory beyond the terminating null byte.

• CWE-193Off-by-one ErrorA product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.