TI-2008-02585 Aliases CVE-2008-2703 GHSA-6xqf-p6pc-2r56

Multiple stack-based buffer overflows in Novell GroupWise Messenger (GWIM) Client before…

HIGH 78CWE-119Published 2008-06-13 · Updated 2024-08-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: Complete · Complete · Complete
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Multiple stack-based buffer overflows in Novell GroupWise Messenger (GWIM) Client before 2.0.3 HP1 for Windows allow remote attackers to execute arbitrary code via "spoofed server responses" that contain a long string after the NM_A_SZ_TRANSACTION_ID field name.

Why it matters now

EPSS 0.61121 99th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:novell:groupwise_messenger:2.0:::::::*	2.0	Vulnerable	Novell
cpe:2.3:a:novell:groupwise_messenger:2.0.2:::::::*	2.0.2	Vulnerable	Novell
cpe:2.3:a:novell:groupwise_messenger:2.0.3:::::::*	2.0.3	Vulnerable	Novell

cpe:2.3:a:novell:groupwise_messenger:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Novell
cpe:2.3:a:novell:groupwise_messenger:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Novell
cpe:2.3:a:novell:groupwise_messenger:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·Novell

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2008-2703
2026-10-03 Alias added: GHSA-6xqf-p6pc-2r56

References

Patch 1

http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5026700.html

Advisory 1

ADV-2008-1764

TI-2006-00962 Stack-based buffer overflow in Novell GroupWise Messenger before 2.0 Public Beta 2 allows… CVSS 2.0HIGH 10.0
TI-2013-00939 Stack-based buffer overflow in the nim: protocol handler in Novell GroupWise Messenger… CVSS 2.0HIGH 9.3
TI-2006-04359 Messenger Agents (nmma.exe) in Novell GroupWise 2.0.2 and 1.0.6 allows remote attackers… CVSS 2.0MEDIUM 5.0
TI-2008-02586 Novell GroupWise Messenger (GWIM) before 2.0.3 Hot Patch 1 allows remote attackers to… CVSS 2.0MEDIUM 5.0
TI-2011-02809 The server process in Novell Messenger 2.1 and 2.2.x before 2.2.1, and Novell GroupWise… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences