ZDI-12-026 : IBM SPSS ExportHTML.dll ActiveX Control Render Method Remote Code Execution Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ZDI-12-026 : IBM SPSS ExportHTML.dll ActiveX Control Render Method Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-026 February 8, 2012 - -- CVE ID: CVE-2012-0190 - -- CVSS: 7.5, AV:N/AC:L/Au:N/C:P/I:P/A:P - --...

CVE-2012-0190

CVE-2012-0190 concerns an RCE in the IBM SPSS ExportHTML.dll ActiveX control (Render method) used by IBM SPSS Dimensions 5.5 and SPSS Data Collection 5.6, 6.0, 6.0.1. The flaw exists in the Render() method of the ExportHTML.ocx/ExportHTML.dll; a crafted HTML document can cause arbitrary file crea...