CVE-2008-4254 Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote attackers to execute arb...
HighCVSS 8.5
EPSS 22.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote attackers to execute arbitrary code via crafted (1) Rows and (2) Cols properties to the (a) ExpandAll and (b) CollapseAll methods, related to access of incorrectly initialized objects and corruption of the "system state," aka "Hierarchical FlexGrid Control Memory Corruption Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft office frontpage | = 2002-sp3 | No fix listed |
| Microsoft project | = 2003-sp3 | No fix listed |
| Microsoft project | = 2007 | No fix listed |
| Microsoft project | = 2007-sp1 | No fix listed |
| Microsoft visual basic | = 6.0 | No fix listed |
| Microsoft visual foxpro | = 8.0-sp1 | No fix listed |
| Microsoft visual foxpro | = 9.0-sp1 | No fix listed |
| Microsoft visual foxpro | = 9.0-sp2 | No fix listed |
| Microsoft visual studio .net | = 2002-sp1 | No fix listed |
| Microsoft visual studio .net | = 2003-sp1 | No fix listed |
References
- secunia.com vendor-advisory
- support.avaya.com
- 20081209 Secunia Research: Microsoft Hierarchical FlexGrid Control Integer Overflows mailing-list
- 1021369 vdb-entry
- TA08-344A third-party-advisory us-government-resource
- ADV-2008-3382 vdb-entry vendor-advisory
- MS08-070 vendor-advisory
- oval:org.mitre.oval:def:5805 signature vdb-entry