| Vulnerability Name: | CVE-2011-1972 (CCN-68811) | ||||||||
| Assigned: | 2011-08-09 | ||||||||
| Published: | 2011-08-09 | ||||||||
| Updated: | 2018-10-12 | ||||||||
| Summary: | Microsoft Visio 2003 SP3, 2007 SP2, and 2010 Gold and SP1 does not properly validate objects in memory during Visio file parsing, which allows remote attackers to execute arbitrary code via a crafted file, aka "pStream Release RCE Vulnerability." | ||||||||
| CVSS v3 Severity: | 10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C) 6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-20 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2011-1972 Source: CCN Type: SA45346 Microsoft Visio Two Vulnerabilities Source: CCN Type: Microsoft Security Bulletin MS11-060 Vulnerabilities in Microsoft Visio Could Allow Remote Code Execution (2560978) Source: CCN Type: BID-49024 Microsoft Visio CVE-2011-1972 Remote Code Execution Vulnerability Source: CERT Type: US Government Resource TA11-221A Source: MS Type: UNKNOWN MS11-060 Source: XF Type: UNKNOWN ms-visio-pstream-cdoe-execution(68811) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:12852 | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||