Will Dormann has reported multiple vulnerabilities in the acpRunner ActiveX control, which can be exploited by malicious people to compromise a user's system.

1) An unspecified format string error exists within the acpRunner (AcpController.dll) ActiveX control.

2) The acpRunner (AcpController.dll) ActiveX control does not properly verify the signature of downloaded packages.

3) The acpRunner (AcpController.dll) ActiveX control does not restrict potentially dangerous operations to certain domains.

The vulnerabilities can potentially be exploited to execute arbitrary code by e.g. tricking a user into visiting a malicious website.

Solution
Apply Automated Solutions Fix Pack 1:
Further details available to Secunia VIM customers

Provided and/or discovered by
Will Dormann, CERT/CC.

Original Advisory
IBM / Lenovo:
http://www-307.ibm.com/pc/support/site.wss/document.do?sitestyle=lenovo&lndocid=MIGR-67649

US-CERT VU#426737:
http://www.kb.cert.org/vuls/id/426737

US-CERT VU#599657:
http://www.kb.cert.org/vuls/id/599657

US-CERT VU#570705:
http://www.kb.cert.org/vuls/id/570705

Deep Links
Links available to Secunia VIM customers