Vulnerability Details : CVE-2008-4254
Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote attackers to execute arbitrary code via crafted (1) Rows and (2) Cols properties to the (a) ExpandAll and (b) CollapseAll methods, related to access of incorrectly initialized objects and corruption of the "system state," aka "Hierarchical FlexGrid Control Memory Corruption Vulnerability."
Vulnerability category: Memory CorruptionExecute code
Products affected by CVE-2008-4254
- cpe:2.3:a:microsoft:project:2003:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:project:2007:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:project:2007:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_basic:6.0:*:runtime_extended_files:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_foxpro:9.0:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio_.net:2002:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_frontpage:2002:sp3:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2008-4254
96.29%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2008-4254
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.5
|
HIGH | AV:N/AC:M/Au:S/C:C/I:C/A:C |
6.8
|
10.0
|
NIST |
CWE ids for CVE-2008-4254
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2008-4254
-
http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm
-
http://www.us-cert.gov/cas/techalerts/TA08-344A.html
Microsoft Updates for Multiple Vulnerabilities | CISAUS Government Resource
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5805
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070
-
http://www.securitytracker.com/id?1021369
-
http://www.vupen.com/english/advisories/2008/3382
Vendor Advisory
-
http://www.securityfocus.com/archive/1/499059/100/0/threaded
Jump to