CVE-2008-1086

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

The HxTocCtrl ActiveX control (hxvz.dll), as used in Microsoft Internet Explorer 5.01 SP4 and 6 SP1, in Windows XP SP2, Server 2003 SP1 and SP2, Vista SP1, and Server 2008, allows remote attackers to execute arbitrary code via malformed arguments, which triggers memory corruption.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-94

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=680Third Party Advisory
http://marc.info/?l=bugtraq&m=120845064910729&w=2Mailing List
http://secunia.com/advisories/29714Vendor Advisory
http://www.securityfocus.com/bid/28606Patch
http://www.securitytracker.com/id?1019800Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-099A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2008/1147/referencesBroken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-023
https://exchange.xforce.ibmcloud.com/vulnerabilities/41464
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5475
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=680Third Party Advisory
http://marc.info/?l=bugtraq&m=120845064910729&w=2Mailing List
http://secunia.com/advisories/29714Vendor Advisory
http://www.securityfocus.com/bid/28606Patch
http://www.securitytracker.com/id?1019800Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA08-099A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2008/1147/referencesBroken Link
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-023
https://exchange.xforce.ibmcloud.com/vulnerabilities/41464
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5475

Timeline

Published: Apr 8, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-10879.3Stack-based buffer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2, Server 2003 SP1 and SP2, Vista, and Server 2008 allows remote atta CVE-2008-10889.3Microsoft Project 2000 Service Release 1, 2002 SP1, and 2003 SP2 allows user-assisted remote attackers to execute arbitrary code via a craft CVE-2008-10899.3Unspecified vulnerability in Microsoft Visio 2002 SP2, 2003 SP2 and SP3, and 2007 up to SP1 allows user-assisted remote attackers to execute CVE-2008-10909.3Unspecified vulnerability in Microsoft Visio 2002 SP2, 2003 SP2 and SP3, and 2007 up to SP1 allows user-assisted remote attackers to execute CVE-2008-10919.3Unspecified vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remot CVE-2008-10929.3Buffer overflow in msjet40.dll before 4.0.9505.0 in Microsoft Jet Database Engine allows remote attackers to execute arbitrary code via a cr CVE-2008-10939.3Acresso InstallShield Update Agent does not properly verify the authenticity of Rule Scripts obtained from GetRules.asp web pages on FLEXnet CVE-2008-10946.5SQL injection vulnerability in index.cgi in the Account View page in Barracuda Spam Firewall (BSF) before 3.5.12.007 allows remote authentic CVE-2008-10956.8Unspecified vulnerability in the Internet Protocol (IP) implementation in Sun Solaris 8, 9, and 10 allows remote attackers to bypass intende CVE-2008-10966.8The load_tile function in the XCF coder in coders/xcf.c in (1) ImageMagick 6.2.8-0 and (2) GraphicsMagick (aka gm) 1.1.7 allows user-assiste CVE-2008-10976.8Heap-based buffer overflow in the ReadPCXImage function in the PCX coder in coders/pcx.c in (1) ImageMagick 6.2.4-5 and 6.2.8-0 and (2) Grap CVE-2008-10984.3Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.5.8 and earlier allow remote attackers to inject arbitrary web script or H