CVE-2008-0379: businessobjects crystal_reports_xi Classic Buffer Overflow
Vulnerability summary
CVE-2008-0379 is a high (CVSS 9.3) Classic Buffer Overflow vulnerability in businessobjects crystal_reports_xi. EPSS estimates a 8.56% chance of exploitation in the next 30 days, higher than 95% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 22-01-2008PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Race condition in the Enterprise Tree ActiveX control (EnterpriseControls.dll 11.5.0.313) in Crystal Reports XI Release 2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the SelectedSession method, which triggers a buffer overflow.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
8.56%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 8.56% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (securityfocus.com)
Maturity: unknown
Crystal Reports XI Release 2 (Enterprise Tree Control) - ActiveX Buffer Overflow (Denial of Service) (PoC)
Maturity: poc
Weaknesses
CWE · root cause- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Affected systems
Businessobjects1 product
1 vendor · 1 product