CVE-2008-0085

MediumCVSS 5.0/10Last modified Jun 16, 2026

Description

SQL Server 7.0 SP4, 2000 SP4, 2005 SP1 and SP2, 2000 Desktop Engine (MSDE 2000) SP4, 2005 Express Edition SP1 and SP2, and 2000 Desktop Engine (WMSDE); Microsoft Data Engine (MSDE) 1.0 SP4; and Internal Database (WYukon) SP2 does not initialize memory pages when reallocating memory, which allows database operators to obtain sensitive information (database contents) via unknown vectors related to memory page reuse.

Metrics

CVSS 2.0 5.0/10AV:N/AC:L/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/30970Vendor Advisory
http://www.securityfocus.com/archive/1/516397/100/0/threadedThird Party Advisory, VDB Entry
http://www.securitytracker.com/id?1020441Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-190A.htmlThird Party Advisory, US Government Resource
http://www.vmware.com/security/advisories/VMSA-2011-0003.htmlPatch, Third Party Advisory
http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.htmlThird Party Advisory
http://www.vupen.com/english/advisories/2008/2022/referencesBroken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-040Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14213Third Party Advisory
http://secunia.com/advisories/30970Vendor Advisory
http://www.securityfocus.com/archive/1/516397/100/0/threadedThird Party Advisory, VDB Entry
http://www.securitytracker.com/id?1020441Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-190A.htmlThird Party Advisory, US Government Resource
http://www.vmware.com/security/advisories/VMSA-2011-0003.htmlPatch, Third Party Advisory
http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.htmlThird Party Advisory
http://www.vupen.com/english/advisories/2008/2022/referencesBroken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-040Patch, Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14213Third Party Advisory

Timeline

Published: Jul 8, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-00869.0Buffer overflow in the convert function in Microsoft SQL Server 2000 SP4, 2000 Desktop Engine (MSDE 2000) SP4, and 2000 Desktop Engine (WMSD CVE-2008-00877.5The DNS client in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, and Vista uses predictable DNS transaction IDs, which allows CVE-2008-00886.8Unspecified vulnerability in Active Directory on Microsoft Windows 2000 and Windows Server 2003, and Active Directory Application Mode (ADAM CVE-2008-00897.5SQL injection vulnerability in uprofile.php in ClipShare allows remote attackers to execute arbitrary SQL commands via the UID parameter.CVE-2008-00905.0A certain ActiveX control in npUpload.dll in DivX Player 6.6.0 allows remote attackers to cause a denial of service (Internet Explorer 7 cra CVE-2008-00916.4Directory traversal vulnerability in download2.php in AGENCY4NET WEBFTP 1 allows remote attackers to read and delete arbitrary files via a .CVE-2008-00924.3Cross-site scripting (XSS) vulnerability in index.php in the search module in Appalachian State University phpWebSite 1.4.0 allows remote at CVE-2008-00934.3Multiple cross-site scripting (XSS) vulnerabilities in newticket.php in eTicket 1.5.5.2, and 1.5.6 RC2 and RC3, allow remote attackers to in CVE-2008-00946.4Multiple directory traversal vulnerabilities in MODx Content Management System 0.9.6.1 allow remote attackers to (1) include and execute arb CVE-2008-00955.0The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance CVE-2008-00967.5Multiple buffer overflows in Georgia SoftWorks SSH2 Server (GSW_SSHD) 7.01.0003 and earlier allow remote attackers to execute arbitrary code CVE-2008-00977.5Format string vulnerability in the log function in Georgia SoftWorks SSH2 Server (GSW_SSHD) 7.01.0003 and earlier allows remote attackers to