CVE-2008-0582: Code Injection

Published Feb 5, 2008

Updated

Cross-zone scripting vulnerability in the Internet Explorer web control in Skype 3.1 through 3.6.0.244 on Windows allows remote attackers to inject arbitrary web script or HTML in the Local Machine Zone via the Full Name field of a reviewer of a business item entry, accessible through (1) the SkypeFind dialog and (2) a skype:?skypefind URI for the skype: URI handler.

Affected Software

5 affected components

Skype Technologies Skype=3.1

Skype Technologies Skype=3.2

Skype Technologies Skype=3.5

Skype Technologies Skype=3.6

Skype Technologies Skype=3.6.0.244

Event History

Feb 5, 2008

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-0582?

CVE-2008-0582 has a moderate severity rating due to its potential for cross-zone scripting attacks.

How do I fix CVE-2008-0582?

To fix CVE-2008-0582, update Skype to a version that is not vulnerable, specifically later than 3.6.0.244.

Which versions of Skype are affected by CVE-2008-0582?

CVE-2008-0582 affects Skype versions 3.1 through 3.6.0.244.

What are the implications of CVE-2008-0582 for users?

Users of affected Skype versions could have their systems exploited to execute arbitrary web scripts or HTML.

Is CVE-2008-0582 a remote vulnerability?

Yes, CVE-2008-0582 is a remote vulnerability that allows attackers to inject scripts through manipulated inputs.