{"api_version":"1","generated_at":"2026-07-23T06:00:33+00:00","cve":"CVE-2008-0660","urls":{"html":"https://cve.report/CVE-2008-0660","api":"https://cve.report/api/cve/CVE-2008-0660.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-0660","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-0660"},"summary":{"title":"CVE-2008-0660","description":"Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0, 4.5.70.0, and 4.5.126.0, and ImageUploader5 5.0.10.0, as used by Facebook PhotoUploader 4.5.57.0, allow remote attackers to execute arbitrary code via long (1) ExtractExif and (2) ExtractIptc properties.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-02-08 02:00:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-119","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"9.3","severity":"","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.securityfocus.com/bid/27576","name":"http://www.securityfocus.com/bid/27576","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Facebook Photo Uploader 4 ActiveX Control 'ExtractIptc/ExtractExif' Buffer Overflow Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/28707","name":"http://secunia.com/advisories/28707","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Aurigma Image Uploader ActiveX Control Property Handling Buffer Overflow - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9060483","name":"http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9060483","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Critical flaws found in MySpace, Facebook ActiveX controls","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/5049","name":"https://www.exploit-db.com/exploits/5049","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"FaceBook PhotoUploader (ImageUploader4.ocx 4.5.57.0) BOF Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/0391/references","name":"http://www.vupen.com/english/advisories/2008/0391/references","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1019297","name":"http://www.securitytracker.com/id?1019297","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - Aurigma Image Uploader Buffer Overflows in ExtractExif() and ExtractIptc() Functions Let Remote Users Execute Arbitrary Code","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/27577","name":"http://www.securityfocus.com/bid/27577","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Aurigma Image Uploader ActiveX Controls 'ExtractIptc/ExtractExif' Buffer Overflow Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://seclists.org/fulldisclosure/2008/Feb/0023.html","name":"http://seclists.org/fulldisclosure/2008/Feb/0023.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Full Disclosure: FaceBook/Aurigma Image/PhotoUploader Buffer Overflow","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.kb.cert.org/vuls/id/776931","name":"http://www.kb.cert.org/vuls/id/776931","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"VU#776931 - Aurigma ImageUploader ActiveX control stack buffer overflows","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/28713","name":"http://secunia.com/advisories/28713","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Facebook Photo Uploader ActiveX Control Property Handling Buffer Overflow - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2008/0394/references","name":"http://www.vupen.com/english/advisories/2008/0394/references","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-0660","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-0660","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"660","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"aurigma","cpe5":"image_uploader_activex_control","cpe6":"4.5.126.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"660","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"aurigma","cpe5":"image_uploader_activex_control","cpe6":"4.5.70.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"660","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"aurigma","cpe5":"image_uploader_activex_control","cpe6":"4.6.17.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"660","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"aurigma","cpe5":"image_uploader_activex_control","cpe6":"5.0.10.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"660","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"facebook","cpe5":"facebook","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"660","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"facebook","cpe5":"photouploader","cpe6":"4.5.57.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T07:54:22.958Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20080203 FaceBook/Aurigma Image/PhotoUploader Buffer Overflow","tags":["mailing-list","x_refsource_FULLDISC","x_transferred"],"url":"http://seclists.org/fulldisclosure/2008/Feb/0023.html"},{"name":"ADV-2008-0394","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/0394/references"},{"name":"27576","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/27576"},{"name":"28707","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/28707"},{"name":"ADV-2008-0391","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2008/0391/references"},{"name":"28713","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/28713"},{"name":"5049","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"],"url":"https://www.exploit-db.com/exploits/5049"},{"name":"27577","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/27577"},{"name":"1019297","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1019297"},{"name":"VU#776931","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/776931"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9060483"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-02-03T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0, 4.5.70.0, and 4.5.126.0, and ImageUploader5 5.0.10.0, as used by Facebook PhotoUploader 4.5.57.0, allow remote attackers to execute arbitrary code via long (1) ExtractExif and (2) ExtractIptc properties."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20080203 FaceBook/Aurigma Image/PhotoUploader Buffer Overflow","tags":["mailing-list","x_refsource_FULLDISC"],"url":"http://seclists.org/fulldisclosure/2008/Feb/0023.html"},{"name":"ADV-2008-0394","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/0394/references"},{"name":"27576","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/27576"},{"name":"28707","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/28707"},{"name":"ADV-2008-0391","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2008/0391/references"},{"name":"28713","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/28713"},{"name":"5049","tags":["exploit","x_refsource_EXPLOIT-DB"],"url":"https://www.exploit-db.com/exploits/5049"},{"name":"27577","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/27577"},{"name":"1019297","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1019297"},{"name":"VU#776931","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/776931"},{"tags":["x_refsource_MISC"],"url":"http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9060483"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-0660","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0, 4.5.70.0, and 4.5.126.0, and ImageUploader5 5.0.10.0, as used by Facebook PhotoUploader 4.5.57.0, allow remote attackers to execute arbitrary code via long (1) ExtractExif and (2) ExtractIptc properties."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20080203 FaceBook/Aurigma Image/PhotoUploader Buffer Overflow","refsource":"FULLDISC","url":"http://seclists.org/fulldisclosure/2008/Feb/0023.html"},{"name":"ADV-2008-0394","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/0394/references"},{"name":"27576","refsource":"BID","url":"http://www.securityfocus.com/bid/27576"},{"name":"28707","refsource":"SECUNIA","url":"http://secunia.com/advisories/28707"},{"name":"ADV-2008-0391","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2008/0391/references"},{"name":"28713","refsource":"SECUNIA","url":"http://secunia.com/advisories/28713"},{"name":"5049","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/5049"},{"name":"27577","refsource":"BID","url":"http://www.securityfocus.com/bid/27577"},{"name":"1019297","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1019297"},{"name":"VU#776931","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/776931"},{"name":"http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9060483","refsource":"MISC","url":"http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9060483"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-0660","datePublished":"2008-02-08T01:00:00.000Z","dateReserved":"2008-02-07T00:00:00.000Z","dateUpdated":"2024-08-07T07:54:22.958Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-02-08 02:00:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-119","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":true,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:aurigma:image_uploader_activex_control:4.5.70.0:*:*:*:*:*:*:*","matchCriteriaId":"0556F443-8B5D-46E4-A6D1-B3C2233F12B7"},{"vulnerable":true,"criteria":"cpe:2.3:a:aurigma:image_uploader_activex_control:4.5.126.0:*:*:*:*:*:*:*","matchCriteriaId":"862FFE86-B759-420B-A3A4-BBBAE22229A6"},{"vulnerable":true,"criteria":"cpe:2.3:a:aurigma:image_uploader_activex_control:4.6.17.0:*:*:*:*:*:*:*","matchCriteriaId":"20F7FBFB-24AA-4CCB-8CEC-E1BC8682574B"},{"vulnerable":true,"criteria":"cpe:2.3:a:aurigma:image_uploader_activex_control:5.0.10.0:*:*:*:*:*:*:*","matchCriteriaId":"F15B9A9B-3218-4E5F-ABFA-0D6BF1DBD926"},{"vulnerable":true,"criteria":"cpe:2.3:a:facebook:facebook:*:*:*:*:*:*:*:*","matchCriteriaId":"0D21D43B-793C-4D67-A6EE-EEE7471920D6"},{"vulnerable":true,"criteria":"cpe:2.3:a:facebook:photouploader:4.5.57.0:*:*:*:*:*:*:*","matchCriteriaId":"6FA99512-97A0-453D-A142-5C743DD9D8D0"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"660","Ordinal":"1","Title":"CVE-2008-0660","CVE":"CVE-2008-0660","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"660","Ordinal":"1","NoteData":"Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0, 4.5.70.0, and 4.5.126.0, and ImageUploader5 5.0.10.0, as used by Facebook PhotoUploader 4.5.57.0, allow remote attackers to execute arbitrary code via long (1) ExtractExif and (2) ExtractIptc properties.","Type":"Description","Title":"CVE-2008-0660"},{"CveYear":"2008","CveId":"660","Ordinal":"2","NoteData":"2008-02-07","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"660","Ordinal":"3","NoteData":"2017-09-28","Type":"Other","Title":"Modified"}]}}}