Chkr_D591

The issue is related to a use-after-free vulnerability in the plugin, which can be exploited by remote attackers through an HTML document with a crafted ` qtactivex ` parameter in an OBJECT element. This can lead to the execution of arbitrary code or cause a denial of service, resulting in an application crash.

The issue is related to a use-after-free vulnerability in the Clear method of the ActiveX control. This vulnerability allows remote attackers to execute arbitrary code or cause a denial of service, resulting in an application crash, via unspecified vectors.

The issue is related to a stack-based buffer overflow in the plugin, which can be triggered by a crafted QTMovie object. This can allow remote attackers to execute arbitrary code or cause the application to crash.

The issue is related to a stack-based buffer overflow in the QuickTime ActiveX control when used with Internet Explorer, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted QTL file.

The issue arises from an ActiveX control in RealPlayer that fails to properly initialize an object component when parsing a CDDA URI. This can be exploited by remote attackers to execute arbitrary code or cause a denial of service, resulting in an uninitialized pointer dereference and application crash, via a long URI.

Name of the Vulnerable Software and Affected Versions: Microsoft Visual Basic 6.0 Visual Studio .NET versions 2002 SP1 and 2003 SP1 Visual FoxPro versions 8.0 SP1, 9.0 SP1, and 9.0 SP2 Office Project versions 2003 SP3 and 2007 Gold and SP1 Description: A heap-based buffer overflow issue exists, allowing remote attackers to execute arbitrary code via a crafted AVI file. This triggers an allocation error and memory corruption. The vulnerability can be exploited by constructing a specially crafted web page, potentially leading to remote code execution when viewed. If successfully exploited, an attacker could gain the same user rights as the logged-on user. Recommendations: For Microsoft Visual Basic 6.0, update to a version that includes the fix for this issue. For Visual Studio .NET versions 2002 SP1 and 2003 SP1, apply the necessary patch or update to a newer version. For Visual FoxPro versions 8.0 SP1, 9.0 SP1, and 9.0 SP2, consider disabling the use of AVI files until a patch is available. For Office Project versions 2003 SP3 and 2007 Gold and SP1, restrict access to crafted web pages to minimize the risk of exploitation.