CVEvulnerability

CVE-2008-1055

7.5 HIGH Published 2008-02-27 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-02-27
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-134

Description

Format string vulnerability in webmail.exe in NetWin SurgeMail 38k4 and earlier and beta 39a, and WebMail 3.1s and earlier, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in the page parameter.

Affected configurations

• netwin surgemail (<= 38k4) • netwin surgemail 1.8a • netwin surgemail 1.8b3 • netwin surgemail 1.8d • netwin surgemail 1.8e • netwin surgemail 1.8g3 • netwin surgemail 1.9 • netwin surgemail 1.9b2 • netwin surgemail 2.0a2 • netwin surgemail 2.0c • netwin surgemail 2.0e • netwin surgemail 2.0g2 • netwin surgemail 2.1a • netwin surgemail 2.1c7 • netwin surgemail 2.2a6 • netwin surgemail 2.2c9 • netwin surgemail 2.2c10 • netwin surgemail 2.2g2 • netwin surgemail 2.2g3 • netwin surgemail 3.0a • netwin surgemail 3.0c2 • netwin surgemail 3.8f3 • netwin surgemail 39a • netwin surgemail beta 39a • netwin webmail (<= 3.1s)

Related

Weakness · CWE (1)

  • CWE-134 Use of Externally-Controlled Format String weakness

References