CVE-2008-4827: Multiple heap-based buffer overflows in the AddTab method in the (1) Tab and (2) CTab ActiveX controls in c1si

This month

HIGH 9.3DOWNGRADEDOWNGRADEDOWNGRADE

CVE-2008-4827 is a high-severity flaw (CVSS 9.3) affecting sizerone, sap gui, tabone. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Multiple heap-based buffer overflows in the AddTab method in the (1) Tab and (2) CTab ActiveX controls in c1sizer.ocx and the (3) TabOne ActiveX control in sizerone.ocx in ComponentOne SizerOne 8.0.20081.140, as used in ComponentOne Studio for ActiveX 2008, TSC2 Help Desk 4.1.8, SAP GUI 6.40 Patch 29 and 7.10, and possibly other products, allow remote attackers to execute arbitrary code by adding many tabs, or adding tabs with long tab captions.

Why this priority

Critical severity
EPSS top 6%: very likely to be exploited

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	9.3 (High)
EPSS exploit chance	6.7% (top 6%)
CISA exploited list	No
Weakness	CWE-119
Published	2009-01-08
Last modified	2026-06-16

Publisher (CNA): Flexera Software LLC · Vendor: componentone · sap · servantix

Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2009-01-08 19:30 UTCPublished CVE record published
2026-06-16 22:58 UTCUpdated Record last modified

componentone sizerone DOWNGRADE

Affected: 8.0.20081.140

Fixed in: no fixed release known

Safe to downgrade to: a release before 8.0.20081.140

1. Check installed version

apt-cache policy sizerone || rpm -q sizerone || sizerone --version

2. No fixed release: DOWNGRADE to a release before 8.0.20081.140 (Debian / Ubuntu)

apt-cache madison sizerone sudo apt install sizerone=<VERSION_BEFORE_8.0.20081.140> sudo apt-mark hold sizerone

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list sizerone sudo dnf downgrade sizerone-<VERSION_BEFORE_8.0.20081.140> sudo dnf versionlock add sizerone

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

sap sap gui DOWNGRADE

Affected: 6.40 · 7.10

Fixed in: no fixed release known

Safe to downgrade to: a release before 6.40

1. Check installed version

apt-cache policy sap-gui || rpm -q sap-gui || sap-gui --version

2. No fixed release: DOWNGRADE to a release before 6.40 (Debian / Ubuntu)

apt-cache madison sap-gui sudo apt install sap-gui=<VERSION_BEFORE_6.40> sudo apt-mark hold sap-gui

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list sap-gui sudo dnf downgrade sap-gui-<VERSION_BEFORE_6.40> sudo dnf versionlock add sap-gui

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

sap tabone DOWNGRADE

Affected: 7.0.0.16

Fixed in: no fixed release known

Safe to downgrade to: a release before 7.0.0.16

1. Check installed version

apt-cache policy tabone || rpm -q tabone || tabone --version

2. No fixed release: DOWNGRADE to a release before 7.0.0.16 (Debian / Ubuntu)

apt-cache madison tabone sudo apt install tabone=<VERSION_BEFORE_7.0.0.16> sudo apt-mark hold tabone

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list tabone sudo dnf downgrade tabone-<VERSION_BEFORE_7.0.0.16> sudo dnf versionlock add tabone

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

servantix tsc2 help desk DOWNGRADE

Affected: 4.18

Fixed in: no fixed release known

Safe to downgrade to: a release before 4.18

1. Check installed version

apt-cache policy tsc2-help-desk || rpm -q tsc2-help-desk || tsc2-help-desk --version

2. No fixed release: DOWNGRADE to a release before 4.18 (Debian / Ubuntu)

apt-cache madison tsc2-help-desk sudo apt install tsc2-help-desk=<VERSION_BEFORE_4.18> sudo apt-mark hold tsc2-help-desk

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list tsc2-help-desk sudo dnf downgrade tsc2-help-desk-<VERSION_BEFORE_4.18> sudo dnf versionlock add tsc2-help-desk

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2008-4827?

sizerone: downgrade or apply the listed mitigation; sap gui: downgrade or apply the listed mitigation; tabone: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2008-4827 being exploited?

CVE-2008-4827 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2008-4827 affect?

CVE-2008-4827 affects sizerone, sap gui, tabone. Severity is high (CVSS 9.3). Multiple heap-based buffer overflows in the AddTab method in the (1) Tab and (2) CTab ActiveX controls in c1sizer.ocx and the (3) TabOne ActiveX control in sizerone.ocx in ComponentOne SizerOne 8.0.20081.140, as used in ComponentOne Studio

How urgent is CVE-2008-4827?

Priority 56/100. Critical severity; EPSS top 6%: very likely to be exploited

Software pages

SAP vulnerabilities

References

← Back to latest CVEs