Design/Logic Flaw

The intu-help-qb aka Intuit Help System Async Pluggable Protocol handlers in HelpAsyncPluggableProtocol.dll in Intuit QuickBooks 2009 through 2012, when Internet Explorer is used, provide different responses to remote requests depending on whether a ZIP pathname is valid, which allows remote...

CVE-2012-2420

CVE-2012-2420 affects Intuit QuickBooks 2009–2012 where the HelpAsyncPluggableProtocol.dll (intu-help-qb) handlers used with Internet Explorer may accidentally disclose sensitive information. The issue arises when processing a URI containing a percent character as its last or second-to-last chara...

Intuit Help System Heap Corruption / Memory Leak

Intuit Help System Protocol URL Heap Corruption and Memory Leak Derek Soeder [email protected] Reported to [email protected] on March 15, 2012; vendor did not respond. Reported to CERT on March 22, 2012; vendor did not respond. Responsible disclosure failed with error code 10060. Published:...