Read the docs
TI-2008-01732 Aliases CVE-2008-1805GHSA-3v37-99mq-jmgr

Incomplete blacklist vulnerability in Skype 3.6.0.248, and other versions before…

Priority MEDIUM 47CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Incomplete blacklist vulnerability in Skype 3.6.0.248, and other versions before 3.8.0.139, allows user-assisted remote attackers to bypass warning dialogs and possibly execute arbitrary code via a file: URI that ends in an executable extension that is not covered by the blacklist.

Why it matters now

EPSS 0.03898 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 43

CPEVersionsRoleVendor
cpe:2.3:a:skype_technologies:skype:*:*:*:*:*:*:*:*up to 3.8.0.115VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.0.0.106:beta:*:*:*:*:*:*3.0.0.106 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.0.0.123:beta:*:*:*:*:*:*3.0.0.123 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.0.0.137:beta:*:*:*:*:*:*3.0.0.137 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.0.0.154:beta:*:*:*:*:*:*3.0.0.154 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.0.0.190:*:*:*:*:*:*:*3.0.0.190VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.0.0.198:*:*:*:*:*:*:*3.0.0.198VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.0.0.205:*:*:*:*:*:*:*3.0.0.205VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.0.0.209:*:*:*:*:*:*:*3.0.0.209VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.0.0.214:*:*:*:*:*:*:*3.0.0.214VulnerableSkype Technologies
  • cpe:2.3:a:skype_technologies:skype:*:*:*:*:*:*:*:* Versions up to 3.8.0.115 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.0.0.106:beta:*:*:*:*:*:* Versions 3.0.0.106 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.0.0.123:beta:*:*:*:*:*:* Versions 3.0.0.123 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.0.0.137:beta:*:*:*:*:*:* Versions 3.0.0.137 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.0.0.154:beta:*:*:*:*:*:* Versions 3.0.0.154 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.0.0.190:*:*:*:*:*:*:* Versions 3.0.0.190 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.0.0.198:*:*:*:*:*:*:* Versions 3.0.0.198 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.0.0.205:*:*:*:*:*:*:* Versions 3.0.0.205 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.0.0.209:*:*:*:*:*:*:* Versions 3.0.0.209 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.0.0.214:*:*:*:*:*:*:* Versions 3.0.0.214 Vulnerable ·Skype Technologies
Show 33 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:skype_technologies:skype:3.0.0.216:*:*:*:*:*:*:*3.0.0.216VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.0.0.217:*:*:*:*:*:*:*3.0.0.217VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.0.0.218:*:*:*:*:*:*:*3.0.0.218VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.1.0.112:beta:*:*:*:*:*:*3.1.0.112 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.1.0.134:beta:*:*:*:*:*:*3.1.0.134 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.1.0.144:*:*:*:*:*:*:*3.1.0.144VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.1.0.147:*:*:*:*:*:*:*3.1.0.147VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.1.0.150:*:*:*:*:*:*:*3.1.0.150VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.1.0.152:*:*:*:*:*:*:*3.1.0.152VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.2.0.53:beta:*:*:*:*:*:*3.2.0.53 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.2.0.63:beta:*:*:*:*:*:*3.2.0.63 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.2.0.82:beta:*:*:*:*:*:*3.2.0.82 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.2.0.115:beta:*:*:*:*:*:*3.2.0.115 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.2.0.145:*:*:*:*:*:*:*3.2.0.145VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.2.0.148:*:*:*:*:*:*:*3.2.0.148VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.2.0.152:*:*:*:*:*:*:*3.2.0.152VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.2.0.158:*:*:*:*:*:*:*3.2.0.158VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.2.0.163:*:*:*:*:*:*:*3.2.0.163VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.2.0.175:*:*:*:*:*:*:*3.2.0.175VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.5.0.107:beta:*:*:*:*:*:*3.5.0.107 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.5.0.158:beta:*:*:*:*:*:*3.5.0.158 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.5.0.178:beta:*:*:*:*:*:*3.5.0.178 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.5.0.202:*:*:*:*:*:*:*3.5.0.202VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.5.0.214:*:*:*:*:*:*:*3.5.0.214VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.5.0.229:*:*:*:*:*:*:*3.5.0.229VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.5.0.234:*:*:*:*:*:*:*3.5.0.234VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.5.0.239:*:*:*:*:*:*:*3.5.0.239VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.6.0.127:beta:*:*:*:*:*:*3.6.0.127 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.6.0.159:beta:*:*:*:*:*:*3.6.0.159 betaVulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.6.0.216:*:*:*:*:*:*:*3.6.0.216VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.6.0.244:*:*:*:*:*:*:*3.6.0.244VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.6.0.248:*:*:*:*:*:*:*3.6.0.248VulnerableSkype Technologies
cpe:2.3:a:skype_technologies:skype:3.8.0.96:beta:*:*:*:*:*:*3.8.0.96 betaVulnerableSkype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.0.0.216:*:*:*:*:*:*:* Versions 3.0.0.216 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.0.0.217:*:*:*:*:*:*:* Versions 3.0.0.217 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.0.0.218:*:*:*:*:*:*:* Versions 3.0.0.218 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.1.0.112:beta:*:*:*:*:*:* Versions 3.1.0.112 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.1.0.134:beta:*:*:*:*:*:* Versions 3.1.0.134 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.1.0.144:*:*:*:*:*:*:* Versions 3.1.0.144 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.1.0.147:*:*:*:*:*:*:* Versions 3.1.0.147 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.1.0.150:*:*:*:*:*:*:* Versions 3.1.0.150 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.1.0.152:*:*:*:*:*:*:* Versions 3.1.0.152 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.2.0.53:beta:*:*:*:*:*:* Versions 3.2.0.53 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.2.0.63:beta:*:*:*:*:*:* Versions 3.2.0.63 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.2.0.82:beta:*:*:*:*:*:* Versions 3.2.0.82 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.2.0.115:beta:*:*:*:*:*:* Versions 3.2.0.115 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.2.0.145:*:*:*:*:*:*:* Versions 3.2.0.145 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.2.0.148:*:*:*:*:*:*:* Versions 3.2.0.148 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.2.0.152:*:*:*:*:*:*:* Versions 3.2.0.152 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.2.0.158:*:*:*:*:*:*:* Versions 3.2.0.158 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.2.0.163:*:*:*:*:*:*:* Versions 3.2.0.163 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.2.0.175:*:*:*:*:*:*:* Versions 3.2.0.175 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.5.0.107:beta:*:*:*:*:*:* Versions 3.5.0.107 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.5.0.158:beta:*:*:*:*:*:* Versions 3.5.0.158 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.5.0.178:beta:*:*:*:*:*:* Versions 3.5.0.178 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.5.0.202:*:*:*:*:*:*:* Versions 3.5.0.202 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.5.0.214:*:*:*:*:*:*:* Versions 3.5.0.214 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.5.0.229:*:*:*:*:*:*:* Versions 3.5.0.229 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.5.0.234:*:*:*:*:*:*:* Versions 3.5.0.234 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.5.0.239:*:*:*:*:*:*:* Versions 3.5.0.239 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.6.0.127:beta:*:*:*:*:*:* Versions 3.6.0.127 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.6.0.159:beta:*:*:*:*:*:* Versions 3.6.0.159 beta Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.6.0.216:*:*:*:*:*:*:* Versions 3.6.0.216 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.6.0.244:*:*:*:*:*:*:* Versions 3.6.0.244 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.6.0.248:*:*:*:*:*:*:* Versions 3.6.0.248 Vulnerable ·Skype Technologies
  • cpe:2.3:a:skype_technologies:skype:3.8.0.96:beta:*:*:*:*:*:* Versions 3.8.0.96 beta Vulnerable ·Skype Technologies

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-1805
  2. 2026-10-03 Alias added: GHSA-3v37-99mq-jmgr
  3. 2026-10-09 EPSS moved to the 90th–95th percentile

References

Patch 1

Advisory 1

Other 1

  • TI-2008-00429 Cross-zone scripting vulnerability in the Internet Explorer web control in Skype… CVSS 2.0HIGH 9.3
  • TI-2005-03092 Integer overflow in Skype client before 1.4.x.84 on Windows, before 1.3.x.17 on Mac OS… CVSS 2.0HIGH 10.0
  • TI-2006-04900 Format string vulnerability in the NSRunAlertPanel function in eBay Skype for Mac… CVSS 2.0HIGH 7.5
  • TI-2005-03091 Buffer overflow in Skype for Windows 1.1.x.0 through 1.4.x.83 allows remote attackers to… CVSS 2.0HIGH 9.3
  • TI-2004-01011 Buffer overflow in the handling of command line arguments in Skype 1.0.x.94 through… CVSS 2.0HIGH 9.3
  • TI-2008-02437 Skype 3.6.0.248, and other versions before 3.8.0.139, uses a case-sensitive comparison… CVSS 2.0HIGH 9.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences