Multiple stack-based buffer overflows in CMailCOM.dll in CMailServer 5.4.6 allow remote attackers to execute arbitrary code via a long argument to the (1) CreateUserPath, (2) Logout, (3) DeleteMailByUID, (4) MoveToInbox, (5) MoveToFolder, (6) DeleteMailEx, (7) GetMailDataEx, (8) SetReplySign, (9) SetForwardSign, and (10) SetReadSign methods, which are not properly handled by (a) the POP3 Class ActiveX control (CMailCom.POP3); or a long argument to the (11) AddAttach, (12) SetSubject, (13) SetBcc, (14) SetBody, (15) SetCc, (16) SetFrom, (17) SetTo, and (18) SetFromUID methods, which are not properly handled by the Class ActiveX control (CMailCOM.SMTP), as demonstrated via the indexOfMail parameter to mwmail.asp.
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2009-08-10T18:00:00
Updated: 2017-09-28T12:57:01
Reserved: 2009-08-10T00:00:00
Link: CVE-2008-6922
JSON object: View
NVD Information
Status : Modified
Published: 2009-08-10T18:30:00.233
Modified: 2017-09-29T01:33:25.200
Link: CVE-2008-6922
JSON object: View
Redhat Information
No data.
CWE