CVE-2008-1101 Buffer overflow in kvdocve.dll in the KeyView document viewing engine in Autonomy (formerly Verity) KeyView, as used by IBM Lotus Notes 7.0.2 and 7.0.3, allows remote attackers to execute arbitrary co...
HighCVSS 9.3
EPSS 5.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in kvdocve.dll in the KeyView document viewing engine in Autonomy (formerly Verity) KeyView, as used by IBM Lotus Notes 7.0.2 and 7.0.3, allows remote attackers to execute arbitrary code via a long pathname, as demonstrated by a long SRC attribute of an IMG element in an HTML document.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| autonomy keyview | = 2.0.0.2 | No fix listed |
| autonomy keyview | = 10.3.0.0 | No fix listed |
| ibm lotus notes | = 6.0 | No fix listed |
| ibm lotus notes | = 6.5 | No fix listed |
| ibm lotus notes | = 7.0 | No fix listed |
| ibm lotus notes | = 7.0.2 | No fix listed |
| ibm lotus notes | = 7.0.3 | No fix listed |
References
- 28140 third-party-advisory vendor-advisory
- 28209 third-party-advisory vendor-advisory
- 28210 third-party-advisory vendor-advisory
- secunia.com vendor-advisory
- www-1.ibm.com
- 20080414 Secunia Research: Lotus Notes kvdocve.dll Path Processing BufferOverflow mailing-list
- 28454 vdb-entry
- ADV-2008-1153 vdb-entry
- ADV-2008-1156 vdb-entry
- autonomy-keyview-kvdocve-bo(41725) vdb-entry