CVE-2005-0490

Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.

• CWE-131

• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000940Broken Link, Patch, Vendor Advisory
• http://marc.info/?l=full-disclosure&m=110959085507755&w=2Mailing List, Patch
• http://www.gentoo.org/security/en/glsa/glsa-200503-20.xmlThird Party Advisory
• http://www.idefense.com/application/poi/display?id=202&type=vulnerabilitiesBroken Link, Vendor Advisory
• http://www.idefense.com/application/poi/display?id=203&type=vulnerabilitiesBroken Link, Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDKSA-2005:048Third Party Advisory
• http://www.novell.com/linux/security/advisories/2005_11_curl.htmlBroken Link
• http://www.redhat.com/support/errata/RHSA-2005-340.htmlBroken Link
• http://www.securityfocus.com/bid/12615Broken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/12616Broken Link, Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19423Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10273Broken Link
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000940Broken Link, Patch, Vendor Advisory
• http://marc.info/?l=full-disclosure&m=110959085507755&w=2Mailing List, Patch
• http://www.gentoo.org/security/en/glsa/glsa-200503-20.xmlThird Party Advisory
• http://www.idefense.com/application/poi/display?id=202&type=vulnerabilitiesBroken Link, Vendor Advisory
• http://www.idefense.com/application/poi/display?id=203&type=vulnerabilitiesBroken Link, Vendor Advisory
• http://www.mandriva.com/security/advisories?name=MDKSA-2005:048Third Party Advisory
• http://www.novell.com/linux/security/advisories/2005_11_curl.htmlBroken Link
• http://www.redhat.com/support/errata/RHSA-2005-340.htmlBroken Link
• http://www.securityfocus.com/bid/12615Broken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/12616Broken Link, Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/19423Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10273Broken Link

Published

May 2, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-0484Format string vulnerability in gprostats for GProFTPD before…
• CVE-2005-0485Cross-site scripting (XSS) vulnerability in comment.php for …
• CVE-2005-0486Tarantella Secure Global Desktop Enterprise Edition 4.00 and…
• CVE-2005-0487Cross-site scripting (XSS) vulnerability in index.php for Ka…
• CVE-2005-0488Certain BSD-based Telnet clients, including those used on So…
• CVE-2005-0489The /proc handling (proc/base.c) Linux kernel 2.4 before 2.4…
• CVE-2005-0491Stack-based buffer overflow in Knox Arkeia Server Backup 5.3…
• CVE-2005-0492Adobe Acrobat Reader 6.0.3 and 7.0.0 allows remote attackers…
• CVE-2005-0493CRLF injection vulnerability in bizmail.cgi in Biz Mail Form…
• CVE-2005-0494The RgSecurity form in the HTTP server for the Thomson TCW69…
• CVE-2005-0495Cross-site scripting (XSS) vulnerability in ZeroBoard allows…
• CVE-2005-0496Arkeia Network Backup Client 5.x contains hard-coded credent…9.8