Unscored severity · published Dec 10, 2008
CVE-2008-4255
Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1…
–
CVSS
53.7%
EPSS
No
On KEV
Description
Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, and Office Project 2003 SP3 and 2007 Gold and SP1 allows remote attackers to execute arbitrary code via an AVI file with a crafted stream length, which triggers an "allocation error" and memory corruption, aka "Windows Common AVI Parsing Overflow Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)53.7% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
Office Frontpage · Microsoft
2002 · source: NVD
PR
Project · Microsoft
2003; 2007; 2007 · source: NVD
VB
Visual Basic · Microsoft
6.0 · source: NVD
VF
Visual Foxpro · Microsoft
8.0; 9.0; 9.0 · source: NVD
VS
Visual Studio .net · Microsoft
2002; 2003 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-4255
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-4255
Exploit
http://downloads.securityfocus.com/vulnerabilities/exploits/32613.pl
support.avaya.com
http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm
www.securityfocus.com
http://www.securityfocus.com/archive/1/499061/100/0/threaded
Patch
http://www.securityfocus.com/bid/32613
www.securitytracker.com
http://www.securitytracker.com/id?1021369
US Government Resource
http://www.us-cert.gov/cas/techalerts/TA08-344A.html
More from Office Frontpage
–
CVE-2008-4256
The Charts ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors…
–
CVE-2008-4254
Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote…
–
CVE-2008-4253
The FlexGrid ActiveX control in Microsoft Visual Basic 6.0, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, Office FrontPage 2002 SP3, and Office Project 2003 SP3 does not properly…
–
CVE-2008-4252
The DataGrid ActiveX control in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized…