Secunia Research has discovered a vulnerability in various SpeedProject products, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to boundary errors in "CxAce60.dll" and "CxAce60u.dll" within the handling of an ACE archive that contains a file with an overly long filename. This can be exploited to cause a stack-based buffer overflow and allows arbitrary code execution when a specially crafted archive is extracted.

The vulnerability has been confirmed in the following products:
* Squeez 5.10 Build 4460
* SpeedCommander 10.52 Build 4450
* SpeedCommander 11.01 Build 4450

Solution
Update to the fixed versions.
Further details available in Customer Area

Provided and/or discovered by
Tan Chew Keong, Secunia Research.

Changelog
Further details available in Customer Area

Original Advisory
Secunia Research:
http://secunia.com/secunia_research/2006-23/advisory/

Deep Links
Links available in Customer Area