CVE-2010-3407

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Stack-based buffer overflow in the MailCheck821Address function in nnotes.dll in the nrouter.exe service in the server in IBM Lotus Domino 8.0.x before 8.0.2 FP5 and 8.5.x before 8.5.1 FP2 allows remote attackers to execute arbitrary code via a long e-mail address in an ORGANIZER:mailto header in an iCalendar calendar-invitation e-mail message, aka SPR NRBY7ZPJ9V.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-119

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Sep 16, 2010
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2010

CVE-2010-34115.0Google Chrome before 6.0.472.59 on Linux does not properly handle cursors, which might allow attackers to cause a denial of service (assertiCVE-2010-34129.3Race condition in the console implementation in Google Chrome before 6.0.472.59 has unspecified impact and attack vectors.CVE-2010-34135.0Unspecified vulnerability in the pop-up blocking functionality in Google Chrome before 6.0.472.59 allows remote attackers to cause a denial CVE-2010-341410.0Google Chrome before 6.0.472.59 on Mac OS X does not properly implement file dialogs, which allows attackers to cause a denial of service (mCVE-2010-341510.0Google Chrome before 6.0.472.59 does not properly implement Geolocation, which allows remote attackers to cause a denial of service (memory CVE-2010-34169.8Google Chrome before 6.0.472.59 on Linux does not properly implement the Khmer locale, which allows remote attackers to cause a denial of seCVE-2010-34175.0Google Chrome before 6.0.472.59 does not prompt the user before granting access to the extension history, which allows attackers to obtain pCVE-2010-34184.3Multiple cross-site scripting (XSS) vulnerabilities in NetArt Media Car Portal 2.0 and earlier allow remote attackers to inject arbitrary weCVE-2010-34197.5Multiple PHP remote file inclusion vulnerabilities in Haudenschilt Family Connections CMS (FCMS) 2.2.3 allow remote attackers to execute arbCVE-2010-34204.3Cross-site scripting (XSS) vulnerability in Products_Results.php in PowerStore 3.0 allows remote attackers to inject arbitrary web script orCVE-2010-34214.3Cross-site scripting (XSS) vulnerability in AffiliateLogin.asp in ProductCart 3, 4.1 SP1, and possibly other versions allows remote attackerCVE-2010-34227.5SQL injection vulnerability in the JGen (com_jgen) component 0.9.33 for Joomla! allows remote attackers to execute arbitrary SQL commands vi
CVE-2010-3407: Critical severity, CVSS 9.3 | Vulnix