Heap-based buffer overflow in the Certificate Trust List (CTL) Provider service (CTLProvider.exe) in Cisco Unified Communications Manager (CUCM) 4.2 before 4.2(3)SR3 and 4.3 before 4.3(1)SR1 and CallManager 4.0 and 4.1 before 4.1(3)SR5c allows remote attackers to cause a denial of service or execute arbitrary code via a long request.