CVE-2015-5040
HighSummary
Buffer overflow in IBM Domino versions 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbitrary code or cause a denial of service (SMTP daemon crash) via a crafted GIF image.
Risk Assessment
Attackers can exploit this vulnerability to execute arbitrary code remotely, potentially leading to serious security and service availability issues.
Recommendation
It is recommended to update IBM Domino to version 8.5.3 FP6 IF10 or 9.0.1 FP4 IF3 to mitigate this vulnerability.
Other vulnerabilities in IBM Domino
See all- CVE-2016-0304High
The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6, when a certain unsupported configuration involving UNC share pathnames is used, allows remote attackers to bypass authentication and possibly execute arbitrary code.
- CVE-2015-4994High
Buffer overflow in IBM Domino versions 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbitrary code or cause a denial of service (SMTP daemon crash) via a crafted GIF image.
- CVE-2015-1903High
A stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary code via a crafted BMP image.
- CVE-2015-1902High
A stack-based buffer overflow in IBM Domino 8.5 before 8.5.3 FP6 IF7 and 9.0 before 9.0.1 FP3 IF3 allows remote attackers to execute arbitrary code via a crafted BMP image.
- CVE-2015-0135High
IBM Domino versions 8.5 before 8.5.3 FP6 IF4 and 9.0 before 9.0.1 FP3 IF2 are vulnerable to remote attacks that can lead to arbitrary code execution or application crash via a crafted GIF image.
- CVE-2015-0179High
In the Notes System Diagnostic (NSD) in IBM Domino 8.5.x before 8.5.3 FP6 IF6 and 9.x before 9.0.1 FP3 IF1, local users can obtain System privilege via unspecified vectors.
- CVE-2015-0134High
Buffer overflow in the SSLv2 implementation in IBM Domino versions 8.5.x before 8.5.1 FP5 IF3, 8.5.2 before FP4 IF3, 8.5.3 before FP6 IF6, 9.0 before IF7, and 9.0.1 before FP2 IF3 allows remote attackers to execute arbitrary code.
Original NVD description (English source)
Buffer overflow in IBM Domino 8.5.1 through 8.5.3 before 8.5.3 FP6 IF10 and 9.x before 9.0.1 FP4 IF3 allows remote attackers to execute arbitrary code or cause a denial of service (SMTP daemon crash) via a crafted GIF image, aka SPRs KLYH9ZDKRE and KLYH9ZTLEZ, a different vulnerability than CVE-2015-4994.