« Volver al listado

CVE-2011-0333

Estado: ModificadaAlta (10)—

Heap-based buffer overflow in the NgwiCalVTimeZoneBody::ParseSelf function in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted TZNAME variable in a VCALENDAR attachment in an e-mail message, related to an "integer truncation error."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Novell — Groupwise

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-0333",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "PSIRT-CNA@flexerasoftware.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-10-08T02:52:52.113",
  "references": [
    {
      "url": "http://secunia.com/secunia_research/2011-66/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://www.novell.com/support/viewContent.do?externalId=7009208",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "https://bugzilla.novell.com/show_bug.cgi?id=678715",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "https://labs.idefense.com/verisign/intelligence/2009/vulnerabilities/display.php?id=943",
      "source": "PSIRT-CNA@flexerasoftware.com"
    },
    {
      "url": "http://secunia.com/secunia_research/2011-66/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.novell.com/support/viewContent.do?externalId=7009208",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.novell.com/show_bug.cgi?id=678715",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://labs.idefense.com/verisign/intelligence/2009/vulnerabilities/display.php?id=943",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in the NgwiCalVTimeZoneBody::ParseSelf function in gwwww1.dll in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted TZNAME variable in a VCALENDAR attachment in an e-mail message, related to an \"integer truncation error.\""
    },
    {
      "lang": "es",
      "value": "Desbordamiento de búfer basado en memoria dinámica en la función NgwiCalVTimeZoneBody::ParseSelf de gwwww1.dll de GroupWise Internet Agent (GWIA) de Novell GroupWise 8.0 anterior a HP3 permite a atacantes remotos ejecutar código de su elección a través de la variable TZNAME manipulada en un adjunto VCALENDAR en un mensaje de correo electrónico. Está relacionado con un \"error de truncado de entero\"."
    }
  ],
  "lastModified": "2026-06-16T23:27:11.813",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:novell:groupwise:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C52E2ABC-20AE-437A-83B0-2E0753787FB5"
            },
            {
              "criteria": "cpe:2.3:a:novell:groupwise:8.0:hp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97206FE4-E1F1-40EC-BC01-A0125FB3B20F"
            },
            {
              "criteria": "cpe:2.3:a:novell:groupwise:8.0:hp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9F7E2A4-3273-45C6-B06E-D6FC22E21DE5"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "PSIRT-CNA@flexerasoftware.com"
}