IBM SPSS Chart2D olch2x32.ocx ActiveX Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM SPSS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the olch2x32.ocx ActiveX control. This object uses the Load() method to load a 2D chart into the browser. When parsing an OC2 file, the code trusts a value at a certain offset. An attacker can alter this value to control the arithmetic done on this value which can result in a user controlled pointer. An attacker can leverage this vulnerability to execute code under the context of the process.