CVE-2012-5946

CVE-2012-5946 affects IBM SPSS SamplePower 3.0 (c1sizer.ocx) where the C1Tab ActiveX control triggers a heap/buffer overflow when handling the TabCaption string, allowing remote code execution. The IBM advisory details that the overflow occurs due to unsafe concatenation (lstrcatA) in TabCaption ...

CVE-2012-0189

IBM SPSS SamplePower 3.0 on Windows is affected by CVE-2012-0189 in the VsVIEW6.ocx ActiveX control (SaveDoc method). The vulnerability allows remote code execution when the ActiveX control is instantiated from Internet Explorer; exploitation requires user interaction (visiting a malicious page o...

CVE-2012-5947

IBM SPSS SamplePower 3.0 contains a vsflex7l ActiveX control vulnerability (CVE-2012-5947) that enables remote code execution when the control is invoked by Internet Explorer. The issue arises from insufficient input validation in the ActiveX component, allowing memory corruption and arbitrary co...

CVE-2012-5945

The CVE-2012-5945 issue affects IBM SPSS SamplePower for Windows (Version 3.0) through the Vsflex8l ActiveX control. The root cause is a buffer overflow in the Vsflex8l ActiveX control triggered when a long string is assigned to the ComboList or ColComboList properties, enabling remote code execu...

CVE-2013-0593

IBM SPSS SamplePower 3.0 for Windows contains a vulnerability in the olch2x32 ActiveX control (olch2x32.ocx) that allows remote code execution when the control is invoked from Internet Explorer. The IBM Security Bulletin notes this affects SamplePower 3.0 with FP001; remediation is to apply the F...

CVE-2014-0895

IBM SPSS SamplePower 3.0.1 (Windows) is affected by CVE-2014-0895 due to a buffer overflow in the vsflex8l ActiveX control’s ComboList property, enabling remote code execution. The vulnerability affects the ActiveX control shipped with SamplePower 3.0.1 before FP1 3.0.1-IM-S3SAMPC-WIN32-FP001-IF0...

CVE-2013-6724

CVE-2013-6724 affects IBM SPSS SamplePower for Windows v3.0.1 through FP1; the vulnerability resides in the vsflex8l ActiveX control (VSFlexGrid8.VSFlexGridL) with the ComboList/ColComboList data handling, allowing remote code execution via a crafted value. IBM notes a fix in SamplePower 3.0.1 FP...