Vulnerability Description
Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote attackers to execute arbitrary code via crafted (1) Rows and (2) Cols properties to the (a) ExpandAll and (b) CollapseAll methods, related to access of incorrectly initialized objects and corruption of the "system state," aka "Hierarchical FlexGrid Control Memory Corruption Vulnerability."
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Office Frontpage | 2002 |
| Microsoft | Project | 2003 |
| Microsoft | Visual Basic | 6.0 |
| Microsoft | Visual Foxpro | 8.0 |
| Microsoft | Visual Studio .Net | 2002 |
Related Weaknesses (CWE)
References
- http://secunia.com/secunia_research/2007-72/Vendor Advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm
- http://www.securityfocus.com/archive/1/499059/100/0/threaded
- http://www.securitytracker.com/id?1021369
- http://www.us-cert.gov/cas/techalerts/TA08-344A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2008/3382Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-07
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3
- http://secunia.com/secunia_research/2007-72/Vendor Advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm
- http://www.securityfocus.com/archive/1/499059/100/0/threaded
- http://www.securitytracker.com/id?1021369
- http://www.us-cert.gov/cas/techalerts/TA08-344A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2008/3382Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-07
FAQ
What is CVE-2008-4254?
CVE-2008-4254 is a vulnerability with a CVSS score of 8.5 (HIGH). Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote attackers to execute arb...
How severe is CVE-2008-4254?
CVE-2008-4254 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-4254?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Office Frontpage, Microsoft Project, Microsoft Visual Basic, Microsoft Visual Foxpro, Microsoft Visual Studio .Net.