CVE-2016-5228

EUVD-2016-6179
Stack-based buffer overflow in the PlayMacro function in ObjectXMacro.ObjectXMacro in WdMacCtl.ocx in Micro Focus Rumba 9.x before 9.3 HF 11997 and 9.4.x before 9.4 HF 12815 allows remote attackers to execute arbitrary code via a long MacroName argument. NOTE: some references mention CVE-2016-5226 but that is not a correct ID for any Rumba vulnerability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 96%
Affected Products (NVD)
VendorProductVersion
microfocusrumba
9.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://community.microfocus.com/microfocus/mainframe_solutions/rumba/w/knowledge_base/28600.micro-focus-rumba-9-x-security-update.aspx
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5327.php
https://cxsecurity.com/issue/WLB-2016050136
https://www.exploit-db.com/exploits/40649/
http://community.microfocus.com/microfocus/mainframe_solutions/rumba/w/knowledge_base/28600.micro-focus-rumba-9-x-security-update.aspx
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5327.php
https://cxsecurity.com/issue/WLB-2016050136
https://www.exploit-db.com/exploits/40649/