# CVEs published 2008-12-10

41 CVEs were published on December 10, 2008: 1 critical, 0 high. Days are UTC.

- [CVE-2008-2249](https://cve.now/CVE-2008-2249.md): Integer overflow in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows r (no CVSS)
- [CVE-2008-3009](https://cve.now/CVE-2008-3009.md): Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1, 9, and 2008 do not properly (no CVSS)
- [CVE-2008-3010](https://cve.now/CVE-2008-3010.md): Microsoft Windows Media Player 6.4, Windows Media Format Runtime 7.1 through 11, and Windows Media Services 4.1 and 9 incorrectly associate (no CVSS)
- [CVE-2008-3465](https://cve.now/CVE-2008-3465.md): Heap-based buffer overflow in an API in GDI in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and (CVSS 9.8)
- [CVE-2008-4024](https://cve.now/CVE-2008-4024.md): Microsoft Office Word 2000 SP3 and 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a Word document wit (no CVSS)
- [CVE-2008-4025](https://cve.now/CVE-2008-4025.md): Integer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 G (no CVSS)
- [CVE-2008-4026](https://cve.now/CVE-2008-4026.md): Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office Compatibility Pack for Word (no CVSS)
- [CVE-2008-4027](https://cve.now/CVE-2008-4027.md): Double free vulnerability in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word View (no CVSS)
- [CVE-2008-4028](https://cve.now/CVE-2008-4028.md): Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office (no CVSS)
- [CVE-2008-4030](https://cve.now/CVE-2008-4030.md): Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; and Off (no CVSS)
- [CVE-2008-4031](https://cve.now/CVE-2008-4031.md): Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Office (no CVSS)
- [CVE-2008-4032](https://cve.now/CVE-2008-4032.md): Microsoft Office SharePoint Server 2007 Gold and SP1 and Microsoft Search Server 2008 do not properly perform authentication and authorizati (no CVSS)
- [CVE-2008-4252](https://cve.now/CVE-2008-4252.md): The DataGrid ActiveX control in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors dur (no CVSS)
- [CVE-2008-4253](https://cve.now/CVE-2008-4253.md): The FlexGrid ActiveX control in Microsoft Visual Basic 6.0, Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2, Office FrontPage 2002 SP3, and Office (no CVSS)
- [CVE-2008-4254](https://cve.now/CVE-2008-4254.md): Multiple integer overflows in the Hierarchical FlexGrid ActiveX control (mshflxgd.ocx) in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 S (no CVSS)
- [CVE-2008-4255](https://cve.now/CVE-2008-4255.md): Heap-based buffer overflow in mscomct2.ocx (aka Windows Common ActiveX control or Microsoft Animation ActiveX control) in Microsoft Visual B (no CVSS)
- [CVE-2008-4256](https://cve.now/CVE-2008-4256.md): The Charts ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 an (no CVSS)
- [CVE-2008-4258](https://cve.now/CVE-2008-4258.md): Microsoft Internet Explorer 5.01 SP4 and 6 SP1 does not properly validate parameters during calls to navigation methods, which allows remote (no CVSS)
- [CVE-2008-4259](https://cve.now/CVE-2008-4259.md): Microsoft Internet Explorer 7 sometimes attempts to access uninitialized memory locations, which allows remote attackers to execute arbitrar (no CVSS)
- [CVE-2008-4260](https://cve.now/CVE-2008-4260.md): Microsoft Internet Explorer 7 sometimes attempts to access a deleted object, which allows remote attackers to execute arbitrary code via a c (no CVSS)
- [CVE-2008-4261](https://cve.now/CVE-2008-4261.md): Stack-based buffer overflow in Microsoft Internet Explorer 5.01 SP4, 6 SP1 on Windows 2000, and 6 on Windows XP and Server 2003 does not pro (no CVSS)
- [CVE-2008-4264](https://cve.now/CVE-2008-4264.md): Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Office Compatibili (no CVSS)
- [CVE-2008-4265](https://cve.now/CVE-2008-4265.md): Microsoft Office Excel 2000 SP3 allows remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed (no CVSS)
- [CVE-2008-4266](https://cve.now/CVE-2008-4266.md): Array index vulnerability in Microsoft Office Excel 2000 SP3, 2002 SP3, and 2003 SP3; Excel Viewer 2003 Gold and SP3; Office 2004 and 2008 f (no CVSS)
- [CVE-2008-4268](https://cve.now/CVE-2008-4268.md): The Windows Search component in Microsoft Windows Vista Gold and SP1 and Server 2008 does not properly free memory during a save operation f (no CVSS)
- [CVE-2008-4269](https://cve.now/CVE-2008-4269.md): The search-ms protocol handler in Windows Explorer in Microsoft Windows Vista Gold and SP1 and Server 2008 uses untrusted parameter data obt (no CVSS)
- [CVE-2008-4837](https://cve.now/CVE-2008-4837.md): Stack-based buffer overflow in Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; Off (no CVSS)
- [CVE-2008-4841](https://cve.now/CVE-2008-4841.md): The WordPad Text Converter for Word 97 files in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 SP1 and SP2 allows remote attackers to e (no CVSS)
- [CVE-2008-5416](https://cve.now/CVE-2008-5416.md): Heap-based buffer overflow in Microsoft SQL Server 2000 SP4, 8.00.2050, 8.00.2039, and earlier; SQL Server 2000 Desktop Engine (MSDE 2000) S (no CVSS)
- [CVE-2008-5417](https://cve.now/CVE-2008-5417.md): HP DECnet-Plus 8.3 before ECO03 for OpenVMS on the Alpha platform uses world-writable permissions for the OSIT$NAMES logical name table, whi (no CVSS)
- [CVE-2008-5418](https://cve.now/CVE-2008-5418.md): Directory traversal vulnerability in login.php in the PunPortal module before 2.0 for PunBB allows remote attackers to include and execute a (no CVSS)
- [CVE-2008-5419](https://cve.now/CVE-2008-5419.md): Stack-based buffer overflow in SAN Manager Master Agent service (aka msragent.exe) in EMC Control Center 5.2 SP5 and 6.0 allows remote attac (no CVSS)
- [CVE-2008-5420](https://cve.now/CVE-2008-5420.md): The SAN Manager Master Agent service (aka msragent.exe) in EMC Control Center before 6.1 does not properly authenticate SST\_SENDFILE request (no CVSS)
- [CVE-2008-4311](https://cve.now/CVE-2008-4311.md): The default configuration of system.conf in D-Bus (aka DBus) before 1.2.6 omits the send\_type attribute in certain rules, which allows local (no CVSS)
- [CVE-2008-5304](https://cve.now/CVE-2008-5304.md): Cross-site scripting (XSS) vulnerability in TWiki before 4.2.4 allows remote attackers to inject arbitrary web script or HTML via the %URLPA (no CVSS)
- [CVE-2008-5305](https://cve.now/CVE-2008-5305.md): Eval injection vulnerability in TWiki before 4.2.4 allows remote attackers to execute arbitrary Perl code via the %SEARCH{}% variable. (no CVSS)
- [CVE-2008-5410](https://cve.now/CVE-2008-5410.md): The PK11\_SESSION cache in the OpenSSL PKCS#11 engine in Sun Solaris 10 does not maintain reference counts for operations with asymmetric key (no CVSS)
- [CVE-2008-5411](https://cve.now/CVE-2008-5411.md): IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 sends SSL traffic over "unsecured TCP," which makes it easier for remote attackers t (no CVSS)
- [CVE-2008-5412](https://cve.now/CVE-2008-5412.md): Unspecified vulnerability in IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 on Windows has unknown impact and attack vectors relate (no CVSS)
- [CVE-2008-5413](https://cve.now/CVE-2008-5413.md): PerfServlet in the PMI/Performance Tools component in IBM WebSphere Application Server (WAS) 7 before 7.0.0.1 allows attackers to obtain sen (no CVSS)
- [CVE-2008-5414](https://cve.now/CVE-2008-5414.md): Unspecified vulnerability in the Feature Pack for Web Services in the Web Services Security component in IBM WebSphere Application Server (W (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2008-12-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.