// For flags

CVE-2008-2829

 

Severity Score

5.0
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

php_imap.c in PHP 5.2.5, 5.2.6, 4.x, and other versions, uses obsolete API calls that allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long IMAP request, which triggers an "rfc822.c legacy routine buffer overflow" error message, related to the rfc822_write_address function.

El archivo php_imap.c en PHP versiones 5.2.5, 5.2.6, 4.x y otras versiones, utiliza llamadas API obsoletas que permiten a los atacantes dependiendo del contexto causar una denegación de servicio (bloqueo) y posiblemente ejecutar código arbitrario por medio de una larga petición IMAP, que activa un mensaje de error "rfc822.c legacy routine buffer overflow", relacionado con la función rfc822_write_address.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2008-06-23 CVE Reserved
  • 2008-06-23 CVE Published
  • 2023-03-07 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (28)
URL Tag Source
http://osvdb.org/46641 Broken Link
http://secunia.com/advisories/31200 Third Party Advisory
http://secunia.com/advisories/32746 Third Party Advisory
http://secunia.com/advisories/35074 Third Party Advisory
http://secunia.com/advisories/35306 Third Party Advisory
http://secunia.com/advisories/35650 Third Party Advisory
http://support.apple.com/kb/HT3549 Third Party Advisory
http://wiki.rpath.com/Advisories:rPSA-2009-0035 Broken Link
http://www.openwall.com/lists/oss-security/2008/06/19/6 Mailing List
http://www.openwall.com/lists/oss-security/2008/06/24/2 Mailing List
http://www.securityfocus.com/archive/1/501376/100/0/threaded Mailing List
http://www.us-cert.gov/cas/techalerts/TA09-133A.html Third Party Advisory
https://bugs.gentoo.org/show_bug.cgi?id=221969 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/43357 Third Party Advisory
URL Date SRC
URL Date SRC
http://www.securityfocus.com/bid/29829 2019-10-09
http://www.vupen.com/english/advisories/2009/1297 2019-10-09
URL Date SRC
http://bugs.php.net/bug.php?id=42862 2019-10-09
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html 2019-10-09
http://lists.opensuse.org/opensuse-security-announce/2008-12/msg00002.html 2019-10-09
http://marc.info/?l=bugtraq&m=124654546101607&w=2 2019-10-09
http://marc.info/?l=bugtraq&m=125631037611762&w=2 2019-10-09
http://security.gentoo.org/glsa/glsa-200811-05.xml 2019-10-09
http://www.mandriva.com/security/advisories?name=MDVSA-2008:126 2019-10-09
http://www.mandriva.com/security/advisories?name=MDVSA-2008:127 2019-10-09
http://www.mandriva.com/security/advisories?name=MDVSA-2008:128 2019-10-09
http://www.ubuntu.com/usn/usn-628-1 2019-10-09
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01451.html 2019-10-09
https://www.redhat.com/archives/fedora-package-announce/2009-May/msg01465.html 2019-10-09
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 <= 4.4.9
Search vendor "Php" for product "Php" and version " <= 4.4.9"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.2.5
Search vendor "Php" for product "Php" and version "5.2.5"
-
Affected
Php
Search vendor "Php"
 Php
Search vendor "Php" for product "Php"
 5.2.6
Search vendor "Php" for product "Php" and version "5.2.6"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 6.06
Search vendor "Canonical" for product "Ubuntu Linux" and version "6.06"
lts
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 7.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "7.04"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 7.10
Search vendor "Canonical" for product "Ubuntu Linux" and version "7.10"
-
Affected
Canonical
Search vendor "Canonical"
 Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
 8.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "8.04"
lts
Affected