Buffer overflow in Dan Cahill Nulllogic Groupware

CVE-2009-2356

Multiple stack-based buffer overflows in the pgsqlQuery function in NullLogic Groupware 1.2.7, when PostgreSQL is used, might allow remote attackers to execute arbitrary code via input to the (1) POP3, (2) SMTP, or (3) web component that triggers a long SQL query.

Vulnerability class: Buffer Overflow

EPSS: 0.039 (89.3th percentile) — read the EPSS interpretation.

Affected products

Dan_cahill Nulllogic_groupware — versions 1.2.7
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

cve@mitre.org (vdb-entry, x_refsource_VUPEN)
cve@mitre.org (x_refsource_MISC)
cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)