CVE-2008-2363

Summary

CVE	CVE-2008-2363
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2008-06-02 21:30:00 UTC
Updated	2026-04-23 00:35:47 UTC
Description	The PartsBatch class in Pan 0.132 and earlier does not properly manage the data structures for Parts batches, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted .nzb file that triggers a heap-based buffer overflow.

Primary CVSS: v2.0 9.3 from [email protected]

AV:N/AC:M/Au:N/C:C/I:C/A:C

Problem Types: CWE-119 | n/a

Access Vector

Network

Access Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

AV:N/AC:M/Au:N/C:C/I:C/A:C

Type	Vendor	Product	Version	Update	Edition	Language
Application	Pan	Pan	0.105	All	All	All
Application	Pan	Pan	0.106	All	All	All
Application	Pan	Pan	0.107	All	All	All
Application	Pan	Pan	0.108	All	All	All
Application	Pan	Pan	0.109	All	All	All
Application	Pan	Pan	0.110	All	All	All
Application	Pan	Pan	0.111	All	All	All
Application	Pan	Pan	0.112	All	All	All
Application	Pan	Pan	0.113	All	All	All
Application	Pan	Pan	0.114	All	All	All
Application	Pan	Pan	0.115	All	All	All
Application	Pan	Pan	0.116	All	All	All
Application	Pan	Pan	0.117	All	All	All
Application	Pan	Pan	0.118	All	All	All
Application	Pan	Pan	0.119	All	All	All
Application	Pan	Pan	0.120	All	All	All
Application	Pan	Pan	0.121	All	All	All
Application	Pan	Pan	0.122	All	All	All
Application	Pan	Pan	0.123	All	All	All
Application	Pan	Pan	0.124	All	All	All
Application	Pan	Pan	0.125	All	All	All
Application	Pan	Pan	0.126	All	All	All
Application	Pan	Pan	0.127	All	All	All
Application	Pan	Pan	0.128	All	All	All
Application	Pan	Pan	0.129	All	All	All
Application	Pan	Pan	0.130	All	All	All
Application	Pan	Pan	0.131	All	All	All
Application	Pan	Pan	All	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

Reference	Source	Link	Tags
IBM X-Force Exchange	af854a3a-2127-422b-91ae-364da2661108	exchange.xforce.ibmcloud.com
Pan '.nzb' File Parsing Heap Overflow Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com	Patch
Pan: User-assisted execution of arbitrary code — Gentoo Linux Documentation	af854a3a-2127-422b-91ae-364da2661108	security.gentoo.org
'[oss-security] CVE-2008-2363: pan - heap overflow' - MARC	af854a3a-2127-422b-91ae-364da2661108	marc.info	Patch
Support / Security / Advisories / / MDVSA-2008:201 \| Mandriva	af854a3a-2127-422b-91ae-364da2661108	www.mandriva.com
SUSE Update for Multiple Packages - Secunia Advisories - Vulnerability Intelligence - Secunia.com	af854a3a-2127-422b-91ae-364da2661108	secunia.com	Vendor Advisory
Gentoo update for pan - Advisories - Secunia	af854a3a-2127-422b-91ae-364da2661108	secunia.com	Vendor Advisory
Bug 446902 – CVE-2008-2363 pan: heap overflow caused by large *.nzb files	af854a3a-2127-422b-91ae-364da2661108	bugzilla.redhat.com
Bug 535413 – [Security] CVE-2008-2363 Buffer overflow in pan when parsing *.nzb files	af854a3a-2127-422b-91ae-364da2661108	bugzilla.gnome.org	Patch
Security Announcement	af854a3a-2127-422b-91ae-364da2661108	www.novell.com
Gentoo Bug 224051 - net-nntp/pan <0.132-r3 Buffer overflow parsing *.nzb files (CVE-2008-2363)	af854a3a-2127-422b-91ae-364da2661108	bugs.gentoo.org	Patch
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Organization	Published	Contributor	Statement
Red Hat	2008-06-03	Mark J Cox	Not vulnerable. This issue did not affect the versions of pan as shipped with Red Hat Enterprise Linux 2.1. No other versions of Red Hat Enterprise Linux have shipped Pan.

There are currently no legacy QID mappings associated with this CVE.