CVE-2008-4252

Microsoft Visual Basic and Visual FoxPro - Remote Code Execution via DataGrid ActiveX Control

Title source: llm

Description

The DataGrid ActiveX control in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "DataGrid Control Memory Corruption Vulnerability."

References (7)

Core 7

Core References

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/3382

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1021369

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/32591

Vendor Advisory x_refsource_confirm

http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm

US Government Resource third-party-advisory x_refsource_cert

http://www.us-cert.gov/cas/techalerts/TA08-344A.html

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5894

Scores

EPSS 0.2098

EPSS Percentile 97.3%

Details

CWE

CWE-264

Status published

Products (8)

microsoft/office_frontpage 2002 sp3

microsoft/project 2003 sp3

microsoft/project 2007 (2 CPE variants)

microsoft/visual_basic 6.0

microsoft/visual_foxpro 8.0 sp1

microsoft/visual_foxpro 9.0 sp1 (2 CPE variants)

microsoft/visual_studio_.net 2002 sp1

microsoft/visual_studio_.net 2003 sp1

Published Dec 10, 2008

Tracked Since Feb 18, 2026