CVE-2008-4827
Estado: ModificadaAlta (9.3)—
Multiple heap-based buffer overflows in the AddTab method in the (1) Tab and (2) CTab ActiveX controls in c1sizer.ocx and the (3) TabOne ActiveX control in sizerone.ocx in ComponentOne SizerOne 8.0.20081.140, as used in ComponentOne Studio for ActiveX 2008, TSC2 Help Desk 4.1.8, SAP GUI 6.40 Patch 29 and 7.10, and possibly other products, allow remote attackers to execute arbitrary code by adding many tabs, or adding tabs with long tab captions.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
- Puntuación base: 9.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 6.71%
- Percentil entre todas las CVEs puntuadas: 94
- Fecha de la puntuación: 3/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (4)
CWE
- CWE-119
Referencias
- http://secunia.com/advisories/32609
- http://secunia.com/advisories/32648
- http://secunia.com/advisories/32672
- http://secunia.com/secunia_research/2008-52/
- http://secunia.com/secunia_research/2008-53/
- http://secunia.com/secunia_research/2008-54/
- http://securityreason.com/securityalert/4879
- http://securitytracker.com/id?1021529
- http://www.securityfocus.com/archive/1/499830/100/0/threaded
- http://www.securityfocus.com/bid/33148
- http://www.vupen.com/english/advisories/2009/0036
- http://www.vupen.com/english/advisories/2009/0037
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47769
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47770
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47771
- http://secunia.com/advisories/32609
- http://secunia.com/advisories/32648
- http://secunia.com/advisories/32672
- http://secunia.com/secunia_research/2008-52/
- http://secunia.com/secunia_research/2008-53/
- http://secunia.com/secunia_research/2008-54/
- http://securityreason.com/securityalert/4879
- http://securitytracker.com/id?1021529
- http://www.securityfocus.com/archive/1/499830/100/0/threaded
- http://www.securityfocus.com/bid/33148
- http://www.vupen.com/english/advisories/2009/0036
- http://www.vupen.com/english/advisories/2009/0037
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47769
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47770
- https://exchange.xforce.ibmcloud.com/vulnerabilities/47771
JSON original (NVD)
Mostrar
{
"id": "CVE-2008-4827",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "PSIRT-CNA@flexerasoftware.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2009-01-08T19:30:11.063",
"references": [
{
"url": "http://secunia.com/advisories/32609",
"tags": [
"Vendor Advisory"
],
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "http://secunia.com/advisories/32648",
"tags": [
"Vendor Advisory"
],
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "http://secunia.com/advisories/32672",
"tags": [
"Vendor Advisory"
],
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "http://secunia.com/secunia_research/2008-52/",
"tags": [
"Vendor Advisory"
],
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "http://secunia.com/secunia_research/2008-53/",
"tags": [
"Vendor Advisory"
],
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "http://secunia.com/secunia_research/2008-54/",
"tags": [
"Vendor Advisory"
],
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "http://securityreason.com/securityalert/4879",
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "http://securitytracker.com/id?1021529",
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "http://www.securityfocus.com/archive/1/499830/100/0/threaded",
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "http://www.securityfocus.com/bid/33148",
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "http://www.vupen.com/english/advisories/2009/0036",
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "http://www.vupen.com/english/advisories/2009/0037",
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47769",
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47770",
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47771",
"source": "PSIRT-CNA@flexerasoftware.com"
},
{
"url": "http://secunia.com/advisories/32609",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/32648",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/32672",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/secunia_research/2008-52/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/secunia_research/2008-53/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/secunia_research/2008-54/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://securityreason.com/securityalert/4879",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://securitytracker.com/id?1021529",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/499830/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/33148",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2009/0036",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2009/0037",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47769",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47770",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47771",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-119"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple heap-based buffer overflows in the AddTab method in the (1) Tab and (2) CTab ActiveX controls in c1sizer.ocx and the (3) TabOne ActiveX control in sizerone.ocx in ComponentOne SizerOne 8.0.20081.140, as used in ComponentOne Studio for ActiveX 2008, TSC2 Help Desk 4.1.8, SAP GUI 6.40 Patch 29 and 7.10, and possibly other products, allow remote attackers to execute arbitrary code by adding many tabs, or adding tabs with long tab captions."
},
{
"lang": "es",
"value": "Múltiples desbordamientos de búfer basados en montículo en el método AddTab en los controles ActiveX (1) Tab y (2) CTab en c1sizer.ocx y control ActiveX (3) TabOne en sizerone.ocx en ComponentOne SizerOne v8.0.20081.140, como el utilizado en ComponentOne Studio para ActiveX 2008, TSC2 Help Desk 4.1.8, SAP GUI 6.40 Patch 29 y v7.10, y posiblemente otros productos, permiten a atacantes remotos ejecutar código de su elección añadiendo muchas pestañas, o añadiendo pestañas con un título largo."
}
],
"lastModified": "2026-06-16T22:58:37.527",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:componentone:sizerone:8.0.20081.140:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ED7DA0C0-8757-468F-A2C0-5E32D20F1525"
},
{
"criteria": "cpe:2.3:a:sap:sap_gui:6.40:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5BF9DC88-FD31-4536-94E9-47A9198826B5"
},
{
"criteria": "cpe:2.3:a:sap:sap_gui:7.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "62CFD60C-5DB5-4EFD-AFBB-773F6304FC5D"
},
{
"criteria": "cpe:2.3:a:sap:tabone:7.0.0.16:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "640CE1EE-F4F6-4625-AC34-171181DDAE12"
},
{
"criteria": "cpe:2.3:a:servantix:tsc2_help_desk:4.18:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "107B41F9-8501-4D87-9184-613EAA7FDC8B"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "PSIRT-CNA@flexerasoftware.com"
}