Vulnerability Description
The GdPicture (1) Light Imaging Toolkit 4.7.1 GdPicture4S.Imaging ActiveX control (gdpicture4s.ocx) 4.7.0.1 and (2) Pro Imaging SDK 5.7.1 GdPicturePro5S.Imaging ActiveX control (gdpicturepro5s.ocx) 5.7.0.1 allows remote attackers to create, overwrite, and modify arbitrary files via the SaveAsPDF method. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs. NOTE: some of these details are obtained from third party information.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dspicture | Light Imaging Toolkit | 4.7.1 |
| Dspicture | Pro Imaging Sdk | 5.7.1 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/31898Vendor Advisory
- http://secunia.com/advisories/31966Vendor Advisory
- http://securityreason.com/securityalert/4355
- http://www.securityfocus.com/bid/31504ExploitPatch
- http://www.vupen.com/english/advisories/2008/2708
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45536
- https://www.exploit-db.com/exploits/6638
- http://secunia.com/advisories/31898Vendor Advisory
- http://secunia.com/advisories/31966Vendor Advisory
- http://securityreason.com/securityalert/4355
- http://www.securityfocus.com/bid/31504ExploitPatch
- http://www.vupen.com/english/advisories/2008/2708
- https://exchange.xforce.ibmcloud.com/vulnerabilities/45536
- https://www.exploit-db.com/exploits/6638
FAQ
What is CVE-2008-4453?
CVE-2008-4453 is a vulnerability with a CVSS score of 9.3 (HIGH). The GdPicture (1) Light Imaging Toolkit 4.7.1 GdPicture4S.Imaging ActiveX control (gdpicture4s.ocx) 4.7.0.1 and (2) Pro Imaging SDK 5.7.1 GdPicturePro5S.Imaging ActiveX control (gdpicturepro5s.ocx) 5....
How severe is CVE-2008-4453?
CVE-2008-4453 has been rated HIGH with a CVSS base score of 9.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2008-4453?
Check the references section above for vendor advisories and patch information. Affected products include: Dspicture Light Imaging Toolkit, Dspicture Pro Imaging Sdk.