CVE-2011-2663 Array index error in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted yearly RRULE variable in a VCALENDAR attachment....

HighCVSS 10.0 EPSS 5.5%

Published: 2011-10-08 04:00
Updated: 2026-06-17 02:31
Exploit status: No public exploit known

Description

Array index error in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before HP3 allows remote attackers to execute arbitrary code via a crafted yearly RRULE variable in a VCALENDAR attachment in an e-mail message.

Affected products

Product	Affected versions	Fixed in
novell groupwise	= 8.0	No fix listed
novell groupwise	= 8.0-hp1	No fix listed
novell groupwise	= 8.0-hp2	No fix listed

References

www.novell.com vendor-advisory
20110928 iDefense Security Advisory 09.26.11: Novell GroupWise iCal Date Invalid Array Indexing Vulnerability mailing-list
bugzilla.novell.com
20110926 Novell GroupWise iCal RRULE Time Conversion Invalid Array Indexing Vulnerability third-party-advisory

CVSS v2.0

10.0 High

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector: Network
Access Complexity: Low
Authentication: None
Confidentiality: Complete
Integrity: Complete
Availability: Complete

Weakness & likelihood

EPSS (exploitation probability, 30 days): 5.50% (percentile 92.9)
CWE: CWE-119

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.