Microsoft Visual Foxpro vulnerabilities

19 CVEs affecting Microsoft Visual Foxpro, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-1856, published 2012-08-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-0158: Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability, published 2012-04-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days. The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office…
CVE-2012-1856: Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability, published 2012-08-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 72% chance of exploitation in the next 30 days. The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL…
CVE-2008-3704, published 2008-08-18. High severity, CVSS 9.3. EPSS: 55.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in the MaskedEdit ActiveX control in Msmask32.ocx 6.0.81.69, and possibly other versions before 6.0.84.18, in Microsoft Visual Studio 6.0, Visual Basic 6.0, Visual Studio…
CVE-2007-4790, published 2007-09-10. High severity, CVSS 7.5. EPSS: 54.9% chance of exploitation in the next 30 days. Stack-based buffer overflow in certain ActiveX controls in (1) FPOLE.OCX 6.0.8450.0 and (2) Foxtlib.ocx, as used in the Microsoft Visual FoxPro 6.0 fpole 1.0 Type Library; and Internet Explorer 5.01,…
CVE-2008-4255, published 2008-12-10. High severity, CVSS 9.3. EPSS: 53.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, Visual…
CVE-2009-2501, published 2009-10-14. High severity, CVSS 9.3. EPSS: 26.7% chance of exploitation in the next 30 days. Heap-based buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1,…
CVE-2009-2500, published 2009-10-14. High severity, CVSS 9.3. EPSS: 23.6% chance of exploitation in the next 30 days. Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…
CVE-2009-3126, published 2009-10-14. High severity, CVSS 9.3. EPSS: 23.5% chance of exploitation in the next 30 days. Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…
CVE-2009-2503, published 2009-10-14. High severity, CVSS 9.3. EPSS: 22.2% chance of exploitation in the next 30 days. GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Windows Server 2003 SP2, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio…
CVE-2008-4254, published 2008-12-10. High severity, CVSS 8.5. EPSS: 22.1% chance of exploitation in the next 30 days. Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 allow remote attackers to execute…

Latest

CVE-2009-2528, published 2009-10-14. High severity, CVSS 9.3. EPSS: 20.5% chance of exploitation in the next 30 days. GDI+ in Microsoft Office XP SP3 does not properly handle malformed objects in Office Art Property Tables, which allows remote attackers to execute arbitrary code via a crafted Office document that…
CVE-2009-2504, published 2009-10-14. High severity, CVSS 9.3. EPSS: 21% chance of exploitation in the next 30 days. Multiple integer overflows in unspecified APIs in GDI+ in Microsoft .NET Framework 1.1 SP1, .NET Framework 2.0 SP1 and SP2, Windows XP SP2 and SP3, Windows Server 2003 SP2, Vista Gold and SP1, Server…
CVE-2009-2502, published 2009-10-14. High severity, CVSS 8.1. EPSS: 22% chance of exploitation in the next 30 days. Buffer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows XP SP2 and SP3, Office XP SP3, Office 2003 SP3, 2007 Microsoft Office System SP1 and SP2, Office Project 2002 SP1, Visio 2002…
CVE-2008-4256, published 2008-12-10. High severity, CVSS 8.5. EPSS: 21% chance of exploitation in the next 30 days. The Charts ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to…