$ cve CVE-2008-0226 JSON

CVE-2008-0226 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 91.6% (pctl 100)

Patch early

A public exploit exists.

Description

Multiple buffer overflows in yaSSL 1.7.5 and earlier, as used in MySQL and possibly other products, allow remote attackers to execute arbitrary code via (1) the ProcessOldClientHello function in handshake.cpp or (2) "input_buffer& operator>>" in yassl_imp.cpp.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	91.6% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-119
On CISA KEV	no
Public exploit	yes
Published	2008-01-10
Last modified	2026-06-16

Affected (6)

Vendor	Product
apple	mac os x
canonical	ubuntu linux
debian	debian linux
mysql	mysql
oracle	mysql
yassl	yassl

Public exploits

Source	Title	Date
exploit-db	MySQL yaSSL (Windows) - SSL Hello Message Buffer Overflow (Metasploit)	2010-05-09
exploit-db	MySQL yaSSL (Linux) - SSL Hello Message Buffer Overflow (Metasploit)	2010-05-09
exploit-db	MySQL 6.0 yaSSL 1.7.5 - Hello Message Buffer Overflow (Metasploit)	2008-01-04

References

→ the Explorer · watch your stack · NVD