CVE-2012-1856

Published: Aug 15, 2012Modified: Apr 22, 2026CISA KEV

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka "MSCOMCTL.OCX RCE Vulnerability."

Affected (21)

Products: Microsoft: Commerce Server, Host Integration Server, Office, Office Web Components, Sql Server, Visual Basic, Visual Foxpro

Microsoft

7 products

Commerce Server

Host Integration Server

Office

Office Web Components

Sql Server

Visual Basic

Visual Foxpro

Configuration A

21 vulnerable

Vulnerable Software	Affected Versions
Microsoft Commerce Server	Version 2002 sp4
Microsoft Commerce Server	Version 2007 sp2
Microsoft Commerce Server	Version 2009
Microsoft Commerce Server	Version 2009 r2
Microsoft Host Integration Server	Version 2004 sp1
Microsoft Office	Version 2003 sp3
Microsoft Office	Version 2007 sp2
Microsoft Office	Version 2007 sp3
Microsoft Office	Version 2010 sp1
Microsoft Office Web Components	Version 2003 sp3
Microsoft Sql Server	Version 2000 sp4
Microsoft Sql Server	Version 2000 sp4
Microsoft Sql Server	Version 2005 sp3
Microsoft Sql Server	Version 2005 sp4
Microsoft Sql Server	Version 2008 r2_sp1
Microsoft Sql Server	Version 2008 r2_sp2
Microsoft Sql Server	Version 2008 sp2
Microsoft Sql Server	Version 2008 sp3
Microsoft Visual Basic	Version 6.0
Microsoft Visual Foxpro	Version 8.0 sp1
Microsoft Visual Foxpro	Version 9.0 sp2