CVE-2011-5167

Oracle Hyperion Strategic Finance < 12.0 - Memory Corruption

Title source: rule

Description

Heap-based buffer overflow in the SetDevNames method of the Tidestone Formula One ActiveX control (TTF16.ocx) 6.3.5 Build 1 in Oracle Hyperion Strategic Finance 12.x and possibly earlier allows remote attackers to execute arbitrary code via a long string to the DriverName parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by rgod · htmlremotewindows

https://www.exploit-db.com/exploits/18092

View Code ZIP pw:eip

References (7)

[Exploit] http://retrogod.altervista.org/9sg_ttf16.html

[Vendor Advisory] http://secunia.com/advisories/46764

[Exploit] http://www.exploit-db.com/exploits/18092

[Various Sources] http://www.saintcorporation.com/cgi-bin/exploit_info/oracle_hyperion_financial_mgmt_activex_heap

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/50565

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/71163

[Third Party Advisory, VDB Entry] http://www.osvdb.org/76913

Scores

EPSS 0.5847

EPSS Percentile 98.2%

Details

CWE

CWE-119

Status published

Products (3)

oracle/hyperion_strategic_finance 11.1.2.1.0

oracle/hyperion_strategic_finance < 12.0

tidestone/formula_one_activex_control 6.3.5.1

Published Sep 15, 2012

Tracked Since Feb 18, 2026