NVD

Id
4102  
Name
CVE-2008-4255  
Description
Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, and Office Project 2003 SP3 and 2007 Gold and SP1 allows remote attackers to execute arbitrary code via an AVI file with a crafted stream length, which triggers an "allocation error" and memory corruption, aka "Windows Common AVI Parsing Overflow Vulnerability."  
Reject
 
CVSS Version
2  
CVSS Score
9.3  
Severity
High  
CVSS Base Score
9.3  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-03  
Published
2008-12-10  
Modified Date
2011-03-07  
Seq
2008-4255  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
26152 4102 CVE-2008-4255 http://downloads.securityfocus.com/vulnerabilities/exploits/32613.pl  View
26153 4102 CVE-2008-4255 oval:org.mitre.oval:def:6032  View
26154 4102 CVE-2008-4255 http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm  View
26155 4102 CVE-2008-4255 MS08-070  View
26156 4102 CVE-2008-4255 20081209 ZDI-08-083: Microsoft Animation ActiveX Control Malformed AVI Parsing Code Execution Vulnerability  View
26157 4102 CVE-2008-4255 32613  View
26158 4102 CVE-2008-4255 1021369  View
26159 4102 CVE-2008-4255 TA08-344A  View
26160 4102 CVE-2008-4255 ADV-2008-3382  View
26161 4102 CVE-2008-4255 http://www.zerodayinitiative.com/advisories/ZDI-08-083  View
26162 4102 CVE-2008-4255 http://www.zerodayinitiative.com/advisories/ZDI-08-083/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
46886 JVNDB-2008-002196 Microsoft Visual Basic の mscomct2.ocx におけるバッファオーバーフローの脆弱性 Microsoft Visual Basic の mscomct2.ocx には、AVI ファイルの処理に不備があるため、ヒープベースのバッファオーバーフローの脆弱性が存在します。 CVE-2008-4255 34368 CVE-2008-4255 4102 8.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002196.html 2008-12-09 2009-01-20 View