CVE-2008-0660 EXPLOIT
9.3
HIGH · CVSS 2.0 · EPSS 37.8% (pctl 98)
Patch early
A public exploit exists.
Description
Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0, 4.5.70.0, and 4.5.126.0, and ImageUploader5 5.0.10.0, as used by Facebook PhotoUploader 4.5.57.0, allow remote attackers to execute arbitrary code via long (1) ExtractExif and (2) ExtractIptc properties.
Scoring
| CVSS | 9.3 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
| EPSS | 37.76% — more likely to be exploited than 98% of all CVEs |
| Weakness | CWE-119 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2008-02-08 |
| Last modified | 2026-06-16 |
Affected (3)
| Vendor | Product |
|---|---|
| aurigma | image uploader activex control |
| photouploader |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | FaceBook PhotoUploader - 'ImageUploader4.ocx 4.5.57.0' Remote Buffer Overflow | 2008-02-03 |
References
- http://seclists.org/fulldisclosure/2008/Feb/0023.html
- http://secunia.com/advisories/28707
- http://secunia.com/advisories/28713
- http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9060483
- http://www.kb.cert.org/vuls/id/776931
- http://www.securityfocus.com/bid/27576
- http://www.securityfocus.com/bid/27577
- http://www.securitytracker.com/id?1019297
- http://www.vupen.com/english/advisories/2008/0391/references
- http://www.vupen.com/english/advisories/2008/0394/references
- https://www.exploit-db.com/exploits/5049
- http://seclists.org/fulldisclosure/2008/Feb/0023.html
- http://secunia.com/advisories/28707
- http://secunia.com/advisories/28713
- http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9060483
- http://www.kb.cert.org/vuls/id/776931
- http://www.securityfocus.com/bid/27576
- http://www.securityfocus.com/bid/27577
- http://www.securitytracker.com/id?1019297
- http://www.vupen.com/english/advisories/2008/0391/references
→ the Explorer · watch your stack · NVD