CVE-2008-3879
The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra...
The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra Shareware Ultra Office Control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destination pathname in the first argument (SaveAsDocument argument) to the Save method.
Exploit likelihood
What each source reports
NVD Score used
The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra Shareware Ultra Office Control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destination pathname in the first argument (SaveAsDocument argument) to the Save method.
- Record
CVE-2008-3879- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra Shareware Ultra Office Control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destination pathname in the first argument (SaveAsDocument argument) to the Save method.
- Record
CVE-2008-3879- Updated
- 2026-11-02
EUVDEUVD-2008-3865 No score
The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra Shareware Ultra Office Control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destination pathname in the first argument (SaveAsDocument argument) to the Save method.
- Record
EUVD-2008-3865- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j6pr-3gfh-7g78 No score
The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra...
The Ultra.OfficeControl ActiveX control in OfficeCtrl.ocx 2.0.2008.801 and earlier in Ultra Shareware Ultra Office Control allows remote attackers to force the download of arbitrary files onto a client system via a URL in the first argument to the Open method, in conjunction with a full destination pathname in the first argument (SaveAsDocument argument) to the Save method.
- Record
GHSA-j6pr-3gfh-7g78- Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Ultra Office - ActiveX Control Arbitrary File Corruption | 2008-08-27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3879 is a high vulnerability (CVSS 9.3) in Ultrashareware Ultra Office Control, published September 2, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.69%, the 89th percentile. No source names a fixed version.
References
exploit-db.com/exploits/6319
securityreason.com/securityalert/4201
exchange.xforce.ibmcloud.com/vulnerabilities/44750
secunia.com/advisories/31632
shinnai.net/xplits/TXT_NPku7jFjRufaz85U6Lxn.html
securityfocus.com/bid/30863
nvd.nist.gov/vuln/detail/CVE-2008-3879
github.com/advisories/GHSA-j6pr-3gfh-7g78