VulnerabilityModified
CVE-2010-0990
Stack-based buffer overflow in Creative Software AutoUpdate Engine ActiveX Control 2.0.12.0, as used in Creative Software AutoUpdate 1.40.01, allows remote attackers to execute arbitrary code via vectors related to the BrowseFolder method.
HIGH 10.0EPSS 4.62%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.62%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Stack-based buffer overflow in Creative Software AutoUpdate Engine ActiveX Control 2.0.12.0, as used in Creative Software AutoUpdate 1.40.01, allows remote attackers to execute arbitrary code via vectors related to the BrowseFolder method.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 4.62% probability · 91th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- creative/autoupdate engine activex control · creative/autoupdate
- Source
- PSIRT-CNA@flexerasoftware.com
References
- http://secunia.com/advisories/38970Vendor Advisory
- http://secunia.com/secunia_research/2010-52/Vendor Advisory
- http://www.securityfocus.com/archive/1/511795/100/0/threaded
- http://www.securityfocus.com/bid/40768
- http://secunia.com/advisories/38970Vendor Advisory
- http://secunia.com/secunia_research/2010-52/Vendor Advisory
- http://www.securityfocus.com/archive/1/511795/100/0/threaded
- http://www.securityfocus.com/bid/40768
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.