CVE-2008-4384

2008-10-0720:00:17

CWE-119

certcc

web.nvd.nist.gov

cve-2008-4384

buffer overflow

mgi software

lpviewer

activex

remote code execution

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.5

Confidence

Low

EPSS

0.611

Percentile

97.8%

JSON

Multiple stack-based buffer overflows in MGI Software LPViewer ActiveX control (LPControl.dll), as acquired by Roxio and iseemedia, allow remote attackers to execute arbitrary code via the (1) url, (2) toolbar, and (3) enableZoomPastMax methods.

Affected configurations

Nvd

Node

iseemedialpviewer

mgi_softwarelpviewer

roxiolpviewer

VendorProductVersionCPE
iseemedialpviewer*cpe:2.3:a:iseemedia:lpviewer:*:*:*:*:*:*:*:*
mgi_softwarelpviewer*cpe:2.3:a:mgi_software:lpviewer:*:*:*:*:*:*:*:*
roxiolpviewer*cpe:2.3:a:roxio:lpviewer:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
iseemedia	lpviewer	*	cpe:2.3:a:iseemedia:lpviewer::::::::
mgi_software	lpviewer	*	cpe:2.3:a:mgi_software:lpviewer::::::::
roxio	lpviewer	*	cpe:2.3:a:roxio:lpviewer::::::::