Doing a deeper dive into the CVE’s, note that both essentially attempt to trick Comodo into connecting to a false server where a malicious file can be downloaded which would infect the system.
The essential part of the attack chain is the connection out to malware command. This is done by the creation of a payload that uses the web delivery module of Metasploit. I acquired and uploaded these Scriptors to Malware Bazaar for your enjoyment:
https://bazaar.abuse.ch/sample/2178aaaa78be8034bd09b3a9035e19cb82f48fd788d5afca3ee3938a729bf0ef/
https://bazaar.abuse.ch/sample/5a598d22aa48b752c7aa66c6977116688b410ed3d2f8fabd43fd16d973b5ba5d/
Note that if either are blocked (contained) the CVE’s just will not work. So although the CVE’s are correct in that Comodo’s Manifest File Handler can potentially be exploited, the actual exploit in reality may be very difficult to implement indeed.
So although a person may or may not want to use Comodo, make sure the decision is not based on uninformed drivel.
(forgot to add that the scripts are heavily obfuscated and contain a Base64-encoded PowerShell command. Upon decoding the command, the scripts are designed to download and execute content from a remote server (long since dead). The script uses powershell.exe with the -nop and -w hidden flags to run the encoded command without displaying a window, thus attempting to conceal activities. The decoded PowerShell command configures a web client to download content from a specified URL and then executes it. The URLs (hxxp://192.168.58.192:8080/OFO8GUCBsT/rqCtAc and hxxp://192.168.58.192:8080/OFO8GUCBsU) is a command and control (C2) server.)