Description
The IMWeb.IMWebControl.1 ActiveX control in IMWeb.dll 7.0.0.x, and possibly IMWebControl.dll, in iMesh 7.1.0.x and earlier allows remote attackers to cause a denial of service (Internet Explorer 7 crash) via an empty string in the argument to the ProcessRequestEx method.
References
- 40240 vdb-entry
- ADV-2007-4240 vdb-entry
- 20071218 iMesh <= 7.1.0.x IMWebControl Class (IMWeb.dll 7.0.0.x) remote exploit mailing-list
- 28134 third-party-advisory
- http://retrogod.altervista.org/rgod_imesh.html