CVE-2008-4256

Microsoft Visual Basic, Visual Studio .NET, and Visual FoxPro - Remote Code Execution via Charts ActiveX Control

Title source: llm

Description

The Charts ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "Charts Control Memory Corruption Vulnerability."

References (7)

Core 7

Core References

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2008/3382

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/32614

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1021369

Vendor Advisory vendor-advisory x_refsource_ms

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070

Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5651

Vendor Advisory x_refsource_confirm

http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm

US Government Resource third-party-advisory x_refsource_cert

http://www.us-cert.gov/cas/techalerts/TA08-344A.html

Scores

EPSS 0.2098

EPSS Percentile 97.3%

Details

CWE

CWE-399

Status published

Products (8)

microsoft/office_frontpage 2002 sp3

microsoft/project 2003 sp3

microsoft/project 2007 (2 CPE variants)

microsoft/visual_basic 6.0

microsoft/visual_foxpro 8.0 sp1

microsoft/visual_foxpro 9.0 sp1 (2 CPE variants)

microsoft/visual_studio_.net 2002 sp1

microsoft/visual_studio_.net 2003 sp1

Published Dec 10, 2008

Tracked Since Feb 18, 2026