CVE-2009-2356

CRITICAL 9.3CVE-2009-2356 · Published 07/07/2009 · updated 16/06/2026

In short

CVE-2009-2356 is a CRITICAL (CVSS 9.3) vulnerability affecting nulllogic groupware (dan cahill).
Chance of exploitation in the next 30 days (EPSS): 3.9%, higher than 90.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
nulllogic groupware dan_cahill	`= 1.2.7`	No fix yet

Description

Multiple stack-based buffer overflows in the pgsqlQuery function in NullLogic Groupware 1.2.7, when PostgreSQL is used, might allow remote attackers to execute arbitrary code via input to the (1) POP3, (2) SMTP, or (3) web component that triggers a long SQL query.

References

nth-dimension.org.uk/utils/get.php
securityfocus.com/archive/1/504737/100/0/threaded
vupen.com/english/advisories/2009/1817

More vulnerabilities in nulllogic groupware

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free