Read the docs
TI-2008-05142 Aliases CVE-2008-5402GHSA-jc8v-wj8g-cw4m

Double free vulnerability in the XML parser in Trillian before 3.1.12.0 allows remote…

Priority MEDIUM 53CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-399 and the CVSS impact.

Summary

Double free vulnerability in the XML parser in Trillian before 3.1.12.0 allows remote attackers to execute arbitrary code via a crafted XML expression, related to the "IMG SRC ID."

Why it matters now

EPSS 0.07049 94th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 55

CPEVersionsRoleVendor
cpe:2.3:a:cerulean_studios:trillian:0.50:*:*:*:*:*:*:*0.50VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.52:*:*:*:*:*:*:*0.52VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.60:*:*:*:*:*:*:*0.60VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.61:*:*:*:*:*:*:*0.61VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.62:*:*:*:*:*:*:*0.62VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.63:*:*:*:*:*:*:*0.63VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.70:*:*:*:*:*:*:*0.70VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.71:*:*:*:*:*:*:*0.71VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.72:*:*:*:*:*:*:*0.72VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.73:*:*:*:*:*:*:*0.73VulnerableCerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.50:*:*:*:*:*:*:* Versions 0.50 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.52:*:*:*:*:*:*:* Versions 0.52 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.60:*:*:*:*:*:*:* Versions 0.60 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.61:*:*:*:*:*:*:* Versions 0.61 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.62:*:*:*:*:*:*:* Versions 0.62 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.63:*:*:*:*:*:*:* Versions 0.63 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.70:*:*:*:*:*:*:* Versions 0.70 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.71:*:*:*:*:*:*:* Versions 0.71 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.72:*:*:*:*:*:*:* Versions 0.72 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.73:*:*:*:*:*:*:* Versions 0.73 Vulnerable ·Cerulean Studios
Show 45 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cerulean_studios:trillian:0.74:*:*:*:*:*:*:*0.74VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.74c:*:*:*:*:*:*:*0.74cVulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.74d:*:*:*:*:*:*:*0.74dVulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.74e:*:*:*:*:*:*:*0.74eVulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.74f:*:*:*:*:*:*:*0.74fVulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.74g:*:*:*:*:*:*:*0.74gVulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.74i:*:*:*:*:*:*:*0.74iVulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.635:*:*:*:*:*:*:*0.635VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.725:*:*:*:*:*:*:*0.725VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:0.6351:*:*:*:*:*:*:*0.6351VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:1.0:*:*:*:*:*:*:*1.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:1.0:*:pro:*:*:*:*:*1.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:2.0:*:*:*:*:*:*:*2.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:2.0:*:pro:*:*:*:*:*2.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:2.1:*:*:*:*:*:*:*2.1VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.0:*:*:*:*:*:*:*3.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.0:*:basic:*:*:*:*:*3.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.0:*:pro:*:*:*:*:*3.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1:*:*:*:*:*:*:*3.1VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1:*:basic:*:*:*:*:*3.1VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1:*:pro:*:*:*:*:*3.1VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1.0.120:*:*:*:*:*:*:*3.1.0.120VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1.0.121:*:*:*:*:*:*:*3.1.0.121VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1.5.0:*:*:*:*:*:*:*3.1.5.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1.5.1:*:*:*:*:*:*:*3.1.5.1VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1.6.0:*:*:*:*:*:*:*3.1.6.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1.7.0:*:*:*:*:*:*:*3.1.7.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1.8.0:*:*:*:*:*:*:*3.1.8.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1.9.0:*:*:*:*:*:*:*3.1.9.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1.9.0:*:basic:*:*:*:*:*3.1.9.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1.9.0:*:pro:*:*:*:*:*3.1.9.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1.10.0:*:*:*:*:*:*:*3.1.10.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian:3.1.11.0:*:*:*:*:*:*:*3.1.11.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian_pro:*:*:*:*:*:*:*:*all versionsVulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian_pro:1.0:*:*:*:*:*:*:*1.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian_pro:2.0:*:*:*:*:*:*:*2.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian_pro:2.01:*:*:*:*:*:*:*2.01VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian_pro:3.0:*:*:*:*:*:*:*3.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian_pro:3.1.5.0:*:*:*:*:*:*:*3.1.5.0VulnerableCerulean Studios
cpe:2.3:a:cerulean_studios:trillian_pro:3.1_build_121:*:*:*:*:*:*:*3.1_build_121VulnerableCerulean Studios
cpe:2.3:a:ceruleanstudios:trillian:*:*:*:*:*:*:*:*all versionsVulnerableCeruleanstudios
cpe:2.3:a:ceruleanstudios:trillian:3.1.0.9:*:*:*:*:*:*:*3.1.0.9VulnerableCeruleanstudios
cpe:2.3:a:ceruleanstudios:trillian:3.1.9.0:*:*:*:*:*:*:*3.1.9.0VulnerableCeruleanstudios
cpe:2.3:a:ceruleanstudios:trillian_pro:*:*:*:*:*:*:*:*all versionsVulnerableCeruleanstudios
cpe:2.3:a:ceruleanstudios:trillian_pro:3.1.9.0:*:*:*:*:*:*:*3.1.9.0VulnerableCeruleanstudios
  • cpe:2.3:a:cerulean_studios:trillian:0.74:*:*:*:*:*:*:* Versions 0.74 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.74c:*:*:*:*:*:*:* Versions 0.74c Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.74d:*:*:*:*:*:*:* Versions 0.74d Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.74e:*:*:*:*:*:*:* Versions 0.74e Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.74f:*:*:*:*:*:*:* Versions 0.74f Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.74g:*:*:*:*:*:*:* Versions 0.74g Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.74i:*:*:*:*:*:*:* Versions 0.74i Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.635:*:*:*:*:*:*:* Versions 0.635 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.725:*:*:*:*:*:*:* Versions 0.725 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:0.6351:*:*:*:*:*:*:* Versions 0.6351 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:1.0:*:pro:*:*:*:*:* Versions 1.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:2.0:*:pro:*:*:*:*:* Versions 2.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.0:*:basic:*:*:*:*:* Versions 3.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.0:*:pro:*:*:*:*:* Versions 3.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1:*:basic:*:*:*:*:* Versions 3.1 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1:*:pro:*:*:*:*:* Versions 3.1 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1.0.120:*:*:*:*:*:*:* Versions 3.1.0.120 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1.0.121:*:*:*:*:*:*:* Versions 3.1.0.121 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1.5.0:*:*:*:*:*:*:* Versions 3.1.5.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1.5.1:*:*:*:*:*:*:* Versions 3.1.5.1 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1.6.0:*:*:*:*:*:*:* Versions 3.1.6.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1.7.0:*:*:*:*:*:*:* Versions 3.1.7.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1.8.0:*:*:*:*:*:*:* Versions 3.1.8.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1.9.0:*:*:*:*:*:*:* Versions 3.1.9.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1.9.0:*:basic:*:*:*:*:* Versions 3.1.9.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1.9.0:*:pro:*:*:*:*:* Versions 3.1.9.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1.10.0:*:*:*:*:*:*:* Versions 3.1.10.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian:3.1.11.0:*:*:*:*:*:*:* Versions 3.1.11.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian_pro:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian_pro:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian_pro:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian_pro:2.01:*:*:*:*:*:*:* Versions 2.01 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian_pro:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian_pro:3.1.5.0:*:*:*:*:*:*:* Versions 3.1.5.0 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:cerulean_studios:trillian_pro:3.1_build_121:*:*:*:*:*:*:* Versions 3.1_build_121 Vulnerable ·Cerulean Studios
  • cpe:2.3:a:ceruleanstudios:trillian:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Ceruleanstudios
  • cpe:2.3:a:ceruleanstudios:trillian:3.1.0.9:*:*:*:*:*:*:* Versions 3.1.0.9 Vulnerable ·Ceruleanstudios
  • cpe:2.3:a:ceruleanstudios:trillian:3.1.9.0:*:*:*:*:*:*:* Versions 3.1.9.0 Vulnerable ·Ceruleanstudios
  • cpe:2.3:a:ceruleanstudios:trillian_pro:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Ceruleanstudios
  • cpe:2.3:a:ceruleanstudios:trillian_pro:3.1.9.0:*:*:*:*:*:*:* Versions 3.1.9.0 Vulnerable ·Ceruleanstudios

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-5402
  2. 2026-10-03 Alias added: GHSA-jc8v-wj8g-cw4m

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences