A vulnerability has been discovered in GdPicture Pro Imaging SDK, which potentially can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to the GdPicturePro5S.Imaging ActiveX control (gdpicturepro5s.ocx) including the insecure "SaveAsPDF()" method. This can be exploited to overwrite arbitrary files on the system in the context of the currently logged-on user.

Successful exploitation may allow execution of arbitrary code.

This is related to:
SA31898

The vulnerability is confirmed in gdpicturepro5s.ocx version 5.7.0.1 included in GdPicture Pro Imaging SDK version 5.7.1. Other versions may also be affected.

Solution
Set the kill-bit for the affected ActiveX control.

Provided and/or discovered by
Originally reported by EgiX in GdPicture Light Imaging Toolkit.

Additional information provided by Secunia Research.

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers