iseemedia 'LPControl.dll' LPViewer ActiveX控件多个缓冲区溢出漏洞

BUGTRAQ ID: 31604 CVE ID：CVE-2008-4384 CNCVE ID：CNCVE-20084384 iseemedia是一款图像处理软件。 iseemedia LPViewer ActiveX控件存在多个基于栈的缓冲区溢出，远程攻击者可以利用漏洞以应用程序权限执行任意指令。 LPControl.dll文件提供了iseemedia LPViewer ActiveX控件，控件对url, toolbar, 和enableZoomPastMax方法处理缺少充分的边界检查，构建恶意HTML文档，诱使用户访问，可导致以应用程序权限执行任意指令。 iseemedia...

Microsoft PicturePusher - ActiveX Cross-Site Arbitrary File Upload

'PicturePusherControl.PostURL = "http://127.0.0.1/?aaaa=1" PicturePusherControl.PostURL = "http://192.168.1.1/?aaaa=1" PicturePusherControl.AddSeperator CRLF = unescape"%0d%0a" FormElementName="aaaa""; file...

CVE-2008-4493: Improper Input Validation

Microsoft PicturePusher ActiveX control PipPPush.DLL 7.00.0709, as used in Microsoft Digital Image 2006 Starter Edition, allows remote attackers to force the upload of arbitrary files by using the AddString and Post methods and a modified PostURL to construct an HTTP POST request. NOTE: this issu...

Microsoft PicturePusher - ActiveX Cross-Site Arbitrary File Upload

Microsoft PicturePusher - ActiveX Cross-Site Arbitrary File Upload 'PicturePusherControl.PostURL = "http://127.0.0.1/?aaaa=1" PicturePusherControl.PostURL = "http://192.168.1.1/?aaaa=1" PicturePusherControl.Add...

Microsoft PicturePusher ActiveX Cross Site File Upload Attack PoC

Exploit for unknown platform in category remote exploits ================================================================= Microsoft PicturePusher ActiveX Cross Site File Upload Attack PoC ================================================================= OBJECT...

Microsoft PicturePusher ActiveX Cross Site File Upload Attack PoC

No description provided by source. !-- Microsoft PicturePusher ActiveX PipPPush.DLL 7.00.0709 remote Cross Site File Upload attack POC IE6 by Nine:Situations:Group::pyrokinesis bug discovered by rgod during early March 2008 tested software: Microsoft Digital Image 2006 Starter Edition works fine...

CVE-2008-4471

Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer ActiveX control AdView.dll 9.0.0.96, as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to overwrite arbitrary files via ".." sequences in the argument to the SaveAS...

CVE-2008-4384

Multiple stack-based buffer overflows in MGI Software LPViewer ActiveX control LPControl.dll, as acquired by Roxio and iseemedia, allow remote attackers to execute arbitrary code via the 1 url, 2 toolbar, and 3 enableZoomPastMax methods...

Directory traversal

Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer ActiveX control AdView.dll 9.0.0.96, as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to overwrite arbitrary files via ".." sequences in the argument to the SaveAS...

Stack overflow

Multiple stack-based buffer overflows in MGI Software LPViewer ActiveX control LPControl.dll, as acquired by Roxio and iseemedia, allow remote attackers to execute arbitrary code via the 1 url, 2 toolbar, and 3 enableZoomPastMax methods...

Security feature bypass

The UpdateEngine class in the LiveUpdate ActiveX control LiveUpdate16.DLL 17.2.56, as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method...

CVE-2008-4472

The CVE-2008-4472 issue is in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56) used by Autodesk products (e.g., Revit Architecture 2009 SP2, Autodesk Design Review 2009). The ApplyPatch method accepts a second argument and can cause arbitrary code execution on a remote Windows host when ...

CVE-2008-4384

CVE-2008-4384 affects the MGI Software LPViewer ActiveX control (LPControl.dll) across Roxio and iseemedia, with stack-based buffer overflows in the url(), toolbar(), and enableZoomPastMax() methods that may allow remote code execution when a crafted HTML page is viewed. The vulnerability is demo...

CVE-2008-4471

The CVE-2008-4471 issue affects the DWF Viewer ActiveX control (AdView.dll 9.0.0.96) used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009. A directory traversal vulnerability in CExpressViewerControl allows remote attackers to overwrite arbitrary files via ".." in the SaveAS argume...

CVE-2008-4471

Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer ActiveX control AdView.dll 9.0.0.96, as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to overwrite arbitrary files via ".." sequences in the argument to the SaveAS...

CVE-2008-4471: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer ActiveX control AdView.dll 9.0.0.96, as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to overwrite arbitrary files via ".." sequences in the argument to the SaveAS...

CVE-2008-4472: Undefined Security Weakness

The UpdateEngine class in the LiveUpdate ActiveX control LiveUpdate16.DLL 17.2.56, as used in Revit Architecture 2009 SP2 and Autodesk Design Review 2009, allows remote attackers to execute arbitrary programs via the second argument to the ApplyPatch method...

Microsoft Rich Textbox ActiveX control SaveFile vulnerability

Added: 10/07/2008 CVE: CVE-2008-0237 BID: 27201 OSVDB: 40234 Background Microsoft Rich Textbox is an ActiveX control which comes with Visual Basic and allows creation of formatted text in RTF files. It is located in the Richtx32.ocx file. Problem The SaveFile method in the Rich Textbox ActiveX...

Microsoft Rich Textbox ActiveX control SaveFile vulnerability

Added: 10/07/2008 CVE: CVE-2008-0237 BID: 27201 OSVDB: 40234 Background Microsoft Rich Textbox is an ActiveX control which comes with Visual Basic and allows creation of formatted text in RTF files. It is located in the Richtx32.ocx file. Problem The SaveFile method in the Rich Textbox ActiveX...

CVE-2008-4384: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple stack-based buffer overflows in MGI Software LPViewer ActiveX control LPControl.dll, as acquired by Roxio and iseemedia, allow remote attackers to execute arbitrary code via the 1 url, 2 toolbar, and 3 enableZoomPastMax methods...