CVE-2011-1207

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

The ActiveBar1 ActiveX control in the Data Dynamics ActiveBar ActiveX controls, as distributed in ActBar.ocx 1.0.6.5 in IBM Rational System Architect 11.4.0.2, 11.4.0.1, and earlier, does not properly restrict the SetLayoutData method, which allows remote attackers to execute arbitrary code via a crafted Data argument, a different vulnerability than CVE-2007-3883. NOTE: some of these details are obtained from third party information.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/43399Vendor Advisory
http://secunia.com/advisories/43474Vendor Advisory
http://securitytracker.com/id?1025464Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/47643Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2011/1129Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=swg21497689Patch, Vendor Advisory
http://secunia.com/advisories/43399Vendor Advisory
http://secunia.com/advisories/43474Vendor Advisory
http://securitytracker.com/id?1025464Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/47643Third Party Advisory, VDB Entry
http://www.vupen.com/english/advisories/2011/1129Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=swg21497689Patch, Vendor Advisory

Timeline

Published: May 5, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-12087.8IBM solidDB 4.5.x before 4.5.182, 6.0.x before 6.0.1069, 6.1.x and 6.3.x before 6.3 FP8 (aka 6.3.49), and 6.5.x before 6.5 FP4 (aka 6.5.0.4)CVE-2011-12094.3IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.39 and 7.0 before 7.0.0.17 uses a weak WS-Security XML encryption algorithm, which m CVE-2011-12139.3Integer underflow in lzhsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrar CVE-2011-12149.3Stack-based buffer overflow in rtfsr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execut CVE-2011-12159.3Stack-based buffer overflow in mw8sr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execut CVE-2011-12169.3Stack-based buffer overflow in assr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute CVE-2011-12179.3Buffer overflow in kpprzrdr.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitra CVE-2011-12189.3Buffer overflow in kvarcve.dll in Autonomy KeyView, as used in IBM Lotus Notes before 8.5.2 FP3, allows remote attackers to execute arbitrar CVE-2011-12209.0Stack-based buffer overflow in lcfd.exe in Tivoli Endpoint in IBM Tivoli Management Framework 3.7.1, 4.1, 4.1.1, and 4.3.1 allows remote aut CVE-2011-12214.3Cross-zone scripting vulnerability in the RealPlayer ActiveX control in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5,CVE-2011-12227.2Buffer overflow in the Journal Based Backup (JBB) feature in the backup-archive client in IBM Tivoli Storage Manager (TSM) before 5.4.3.4, 5 CVE-2011-12237.2Buffer overflow in the Alternate Data Stream (aka ADS or named stream) functionality in the backup-archive client in IBM Tivoli Storage Mana