← Vulnerability feed

Vulnerability record · CVE-2008-5440 · published 14 January 2009

CVE-2008-5440: Oracle timesten in-memory database vulnerability

Oracle · Timesten In Memory Database

Unspecified vulnerability in the TimesTen Data Server component in Oracle Database 7.0.5.0.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this is a format string vulnerability via the msg parameter in the evtdump CGI module.

7.5 CVSS 2.0 High EPSS 12% · top 4.0%
7.5CVSS 2.0 base score
12%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
18References
16 Jun 2026Last modified by NVD

Description

Unspecified vulnerability in the TimesTen Data Server component in Oracle Database 7.0.5.0.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2009 CPU. Oracle has not commented on reliable researcher claims that this is a format string vulnerability via the msg parameter in the evtdump CGI module.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://joxeankoret.com/blog/?p=41
http://secunia.com/advisories/33525 Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2009-097901.html
http://www.securityfocus.com/archive/1/500078/100/0/threaded
http://www.securityfocus.com/archive/1/500080/100/0/threaded
http://www.securityfocus.com/bid/33177
http://www.vupen.com/english/advisories/2009/0115 Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-09-004
http://www.zerodayinitiative.com/advisories/ZDI-09-004/
http://joxeankoret.com/blog/?p=41
http://secunia.com/advisories/33525 Vendor Advisory
http://www.oracle.com/technetwork/topics/security/cpujan2009-097901.html
http://www.securityfocus.com/archive/1/500078/100/0/threaded
http://www.securityfocus.com/archive/1/500080/100/0/threaded
http://www.securityfocus.com/bid/33177
http://www.vupen.com/english/advisories/2009/0115 Vendor Advisory
http://www.zerodayinitiative.com/advisories/ZDI-09-004
http://www.zerodayinitiative.com/advisories/ZDI-09-004/

Track CVE-2008-5440 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2010-0873Oracle timesten in-memory database vulnerabilityUnspecified vulnerability in the Data Server component in Oracle TimesTen In-Memory Database 7.0.6.0 allows remote attackers to affect confidentialit…EPSS 2.0%9.9CVE-2026-60402Oracle timesten in-memory database improper access control vulnerabilityVulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database (component: Kubernetes Operator). The supported versio…EPSS 0.43%9.8CVE-2019-11834Davegamble cjson out-of-bounds read vulnerabilitycJSON before 1.7.11 allows out-of-bounds access, related to \x00 in a string literal.EPSS 2.5%9.8CVE-2019-11835Davegamble cjson out-of-bounds read vulnerabilitycJSON before 1.7.11 allows out-of-bounds access, related to multiline comments.EPSS 2.6%9.8CVE-2018-11058Dell bsafe out-of-bounds read vulnerabilityRSA BSAFE Micro Edition Suite, versions prior to 4.0.11 (in 4.0.x) and prior to 4.1.6 (in 4.1.x), and RSA BSAFE Crypto-C Micro Edition, version prior…EPSS 4.0%9.8CVE-2017-5645Apache Log4j 2 socket server deserialization allows remote code executionApache Log4j 2.x before 2.8.2 deserializes binary log events received over its TCP or UDP socket server without validating the payload. A crafted ser…EPSS 90%analysed8.3CVE-2021-2351Oracle advanced networking option broken cryptographic algorithm vulnerabilityVulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and …EPSS 2.4%7.5CVE-2021-41772Golang go improper input validation vulnerabilityGo before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty f…EPSS 3.3%

Source: NIST National Vulnerability Database (record CVE-2008-5440), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.