CVE-2008-4827

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-01-08 · updated 2026-06-16
Weakness: CWE-119

Description

Multiple heap-based buffer overflows in the AddTab method in the (1) Tab and (2) CTab ActiveX controls in c1sizer.ocx and the (3) TabOne ActiveX control in sizerone.ocx in ComponentOne SizerOne 8.0.20081.140, as used in ComponentOne Studio for ActiveX 2008, TSC2 Help Desk 4.1.8, SAP GUI 6.40 Patch 29 and 7.10, and possibly other products, allow remote attackers to execute arbitrary code by adding many tabs, or adding tabs with long tab captions.

Affected products

Componentone Sizerone: 8.0.20081.140
Sap Gui: 6.40, 7.10
SAP Tabone: 7.0.0.16
Servantix Tsc2 Help Desk: 4.18

References

http://secunia.com/advisories/32609
http://secunia.com/advisories/32648
http://secunia.com/advisories/32672
http://secunia.com/secunia_research/2008-52/
http://secunia.com/secunia_research/2008-53/
http://secunia.com/secunia_research/2008-54/
http://securityreason.com/securityalert/4879
http://securitytracker.com/id?1021529
http://www.securityfocus.com/archive/1/499830/100/0/threaded
http://www.securityfocus.com/bid/33148
http://www.vupen.com/english/advisories/2009/0036
http://www.vupen.com/english/advisories/2009/0037

Get alerted when CVE-2008-4827 or the next vulnerability affects your stack