← Vulnerability feed

Vulnerability record · CVE-2008-0660 · published 8 February 2008

CVE-2008-0660: Aurigma image uploader activex control memory buffer overflow vulnerability

Aurigma · Image Uploader Activex Control

Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0, 4.5.70.0, and 4.5.126.0, and ImageUploader5 5.0.10.0, as used by Facebook PhotoUploader 4.5.57.0, allow remote attackers to execute arbitrary code via long (1) ExtractExif and (2) ExtractIptc properties.

9.3 CVSS 2.0 High EPSS 38% · top 1.5% CWE-119 · Memory buffer overflow
9.3CVSS 2.0 base score
38%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
22References
16 Jun 2026Last modified by NVD

Description

Multiple stack-based buffer overflows in Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.6.17.0, 4.5.70.0, and 4.5.126.0, and ImageUploader5 5.0.10.0, as used by Facebook PhotoUploader 4.5.57.0, allow remote attackers to execute arbitrary code via long (1) ExtractExif and (2) ExtractIptc properties.

AV:N/AC:M/Au:N/C:C/I:C/A:C

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://seclists.org/fulldisclosure/2008/Feb/0023.html
http://secunia.com/advisories/28707 Vendor Advisory
http://secunia.com/advisories/28713 Vendor Advisory
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9060483
http://www.kb.cert.org/vuls/id/776931 US Government Resource
http://www.securityfocus.com/bid/27576
http://www.securityfocus.com/bid/27577
http://www.securitytracker.com/id?1019297
http://www.vupen.com/english/advisories/2008/0391/references
http://www.vupen.com/english/advisories/2008/0394/references
https://www.exploit-db.com/exploits/5049
http://seclists.org/fulldisclosure/2008/Feb/0023.html
http://secunia.com/advisories/28707 Vendor Advisory
http://secunia.com/advisories/28713 Vendor Advisory
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9060483
http://www.kb.cert.org/vuls/id/776931 US Government Resource
http://www.securityfocus.com/bid/27576
http://www.securityfocus.com/bid/27577
http://www.securitytracker.com/id?1019297
http://www.vupen.com/english/advisories/2008/0391/references
http://www.vupen.com/english/advisories/2008/0394/references
https://www.exploit-db.com/exploits/5049

Track CVE-2008-0660 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-0659Aurigma Image Uploader ActiveX Control Stack Buffer OverflowThe Aurigma Image Uploader ActiveX control (ImageUploader4.ocx) 4.5.70 and earlier, also shipped as MySpace MySpaceUploader.ocx 1.0.0.4, contains a s…EPSS 56%analysed9.3CVE-2008-5711Facebook photouploader memory buffer overflow vulnerabilityHeap-based buffer overflow in the Facebook PhotoUploader ActiveX control 5.0.14.0 and earlier allows remote attackers to execute arbitrary code via a…EPSS 33%9.3CVE-2008-1490Aurigma image uploader activex control memory buffer overflow vulnerabilityBuffer overflow in a certain Aurigma ActiveX control in ImageUploader4.ocx 4.1.36.0, as used with Piczo (aka Pizco) and possibly other online service…EPSS 4.0%8.8CVE-2021-24218Facebook cross-site request forgery vulnerabilityThe wp_ajax_save_fbe_settings and wp_ajax_delete_fbe_settings AJAX actions of the Facebook for WordPress plugin before 3.0.4 were vulnerable to CSRF …EPSS 0.70%8.1CVE-2021-24217Facebook deserialization of untrusted data vulnerabilityThe run_action function of the Facebook for WordPress plugin before 3.0.0 deserializes user supplied data making it possible for PHP objects to be su…EPSS 3.5%4.3CVE-2014-6392Facebook cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in the Facebook app 14.0 and the Facebook Messenger app 10.0 for iOS allows remote attackers to inject arbit…EPSS 0.94%9.5CVE-2026-88772Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityVulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 F…KEV8.8CVE-2026-8452Citrix NetScaler ADC and Gateway memory buffer overflow causes DoSCVE-2026-8452 is a memory buffer overflow (CWE-119) in Citrix NetScaler ADC and NetScaler Gateway that leads to unpredictable or erroneous behavior a…KEVEPSS 1.0%analysed

Source: NIST National Vulnerability Database (record CVE-2008-0660), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.