critical9.3Public exploit code

CVE-2008-4255

Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual St…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Microsoft Visual Basic - ActiveX Controls mscomct2.ocx Buffer Overflow (PoC)2008-12-12 · dos · windows · Verified

Impact

Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, and Office Project 2003 SP3 and 2007 Gold and SP1 allows remote attackers to execute arbitrary code via an AVI file with a crafted stream length, which triggers an "allocation error" and memory corruption, aka "Windows Common AVI Parsing Overflow Vulnerability."

Affected products

Vendor	Product	Affected versions
Microsoft	Office Frontpage	Version 2002
Microsoft	Project	Versions 2003, 2007
Microsoft	Visual Basic	Version 6.0
Microsoft	Visual Foxpro	Versions 8.0, 9.0
Microsoft	Visual Studio .Net	Versions 2002, 2003

Weakness classification

CWE-119

Public exploit code

Impact

Affected products

Weakness classification

References