CVE-2008-4254

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-12-09T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote attackers to execute arbitrary code via crafted (1) Rows and (2) Cols properties to the (a) ExpandAll and (b) CollapseAll methods, related to access of incorrectly initialized objects and corruption of the \"system state,\" aka \"Hierarchical FlexGrid Control Memory Corruption Vulnerability.\""}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-12T19:57:01.000Z", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft"}, "references": [{"name": "oval:org.mitre.oval:def:5805", "tags": ["vdb-entry", "signature", "x_refsource_OVAL"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5805"}, {"name": "ADV-2008-3382", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/3382"}, {"tags": ["x_refsource_MISC"], "url": "http://secunia.com/secunia_research/2007-72/"}, {"name": "1021369", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1021369"}, {"name": "MS08-070", "tags": ["vendor-advisory", "x_refsource_MS"], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070"}, {"name": "20081209 Secunia Research: Microsoft Hierarchical FlexGrid Control Integer Overflows", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/499059/100/0/threaded"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm"}, {"name": "TA08-344A", "tags": ["third-party-advisory", "x_refsource_CERT"], "url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@microsoft.com", "ID": "CVE-2008-4254", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote attackers to execute arbitrary code via crafted (1) Rows and (2) Cols properties to the (a) ExpandAll and (b) CollapseAll methods, related to access of incorrectly initialized objects and corruption of the \"system state,\" aka \"Hierarchical FlexGrid Control Memory Corruption Vulnerability.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "oval:org.mitre.oval:def:5805", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5805"}, {"name": "ADV-2008-3382", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/3382"}, {"name": "http://secunia.com/secunia_research/2007-72/", "refsource": "MISC", "url": "http://secunia.com/secunia_research/2007-72/"}, {"name": "1021369", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1021369"}, {"name": "MS08-070", "refsource": "MS", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070"}, {"name": "20081209 Secunia Research: Microsoft Hierarchical FlexGrid Control Integer Overflows", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/499059/100/0/threaded"}, {"name": "http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm", "refsource": "CONFIRM", "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm"}, {"name": "TA08-344A", "refsource": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T10:08:34.976Z"}, "title": "CVE Program Container", "references": [{"name": "oval:org.mitre.oval:def:5805", "tags": ["vdb-entry", "signature", "x_refsource_OVAL", "x_transferred"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5805"}, {"name": "ADV-2008-3382", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2008/3382"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://secunia.com/secunia_research/2007-72/"}, {"name": "1021369", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1021369"}, {"name": "MS08-070", "tags": ["vendor-advisory", "x_refsource_MS", "x_transferred"], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070"}, {"name": "20081209 Secunia Research: Microsoft Hierarchical FlexGrid Control Integer Overflows", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/499059/100/0/threaded"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm"}, {"name": "TA08-344A", "tags": ["third-party-advisory", "x_refsource_CERT", "x_transferred"], "url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html"}]}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2008-4254", "datePublished": "2008-12-10T13:33:00.000Z", "dateReserved": "2008-09-25T00:00:00.000Z", "dateUpdated": "2024-08-07T10:08:34.976Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "secure@microsoft.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office_frontpage:2002:sp3:*:*:*:*:*:*", "matchCriteriaId": "F2D429D9-577E-4CD6-ADEC-1119B60DB20F", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:project:2003:sp3:*:*:*:*:*:*", "matchCriteriaId": "25881D4B-06E5-4083-AEEF-B6E1CE5C459A", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:project:2007:*:*:*:*:*:*:*", "matchCriteriaId": "9CD3B021-8145-49FA-8809-C3976ED1BE62", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:project:2007:sp1:*:*:*:*:*:*", "matchCriteriaId": "145E1D64-840B-4AE8-91CB-EA4884ED51D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_basic:6.0:*:runtime_extended_files:*:*:*:*:*", "matchCriteriaId": "DD65D7E8-016B-44EC-A416-E9247810CFF3", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_foxpro:8.0:sp1:*:*:*:*:*:*", "matchCriteriaId": "E5DE8B76-FA09-4EA2-9535-758C56C4C099", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_foxpro:9.0:sp1:*:*:*:*:*:*", "matchCriteriaId": "478347F8-6256-4DE6-AD6A-91631A9E6DD1", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_foxpro:9.0:sp2:*:*:*:*:*:*", "matchCriteriaId": "5E711CC3-9094-4C54-A794-9C7A3E7F4AFA", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_.net:2002:sp1:*:*:*:*:*:*", "matchCriteriaId": "747E3E3A-85C1-4E55-B7F8-C5207F247498", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:visual_studio_.net:2003:sp1:*:*:*:*:*:*", "matchCriteriaId": "85959AEB-2FE5-4A25-B298-F8223CE260D6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote attackers to execute arbitrary code via crafted (1) Rows and (2) Cols properties to the (a) ExpandAll and (b) CollapseAll methods, related to access of incorrectly initialized objects and corruption of the \"system state,\" aka \"Hierarchical FlexGrid Control Memory Corruption Vulnerability.\""}, {"lang": "es", "value": "M\u00faltiples desbordamientos de enteros en el control ActiveX de Hierarchical FlexGrid (en el archivo mshflxgd.ocx) en Visual Basic versi\u00f3n 6.0 y Visual FoxPro versiones 8.0 SP1 y 9.0 SP1 y SP2, de Microsoft, permiten a los atacantes remotos ejecutar c\u00f3digo arbitrario por medio de las propiedades dise\u00f1adas (1) Rows y (2) Cols de los m\u00e9todos (a) ExpandAll y (b) CollapseAll, relacionados con el acceso a objetos inicializados incorrectamente y la corrupci\u00f3n del \"system state,\" tambi\u00e9n se conoce como \"Hierarchical FlexGrid Control Memory Corruption Vulnerability.\""}], "id": "CVE-2008-4254", "lastModified": "2026-06-16T22:57:29.903", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "COMPLETE", "baseScore": 8.5, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2008-12-10T14:00:00.957", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/secunia_research/2007-72/"}, {"source": "secure@microsoft.com", "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm"}, {"source": "secure@microsoft.com", "url": "http://www.securityfocus.com/archive/1/499059/100/0/threaded"}, {"source": "secure@microsoft.com", "url": "http://www.securitytracker.com/id?1021369"}, {"source": "secure@microsoft.com", "tags": ["US Government Resource"], "url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html"}, {"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2008/3382"}, {"source": "secure@microsoft.com", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070"}, {"source": "secure@microsoft.com", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5805"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/secunia_research/2007-72/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/499059/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1021369"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["US Government Resource"], "url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2008/3382"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5805"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-189"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}