CVE-2010-2990
Citrix Online Plug-in for Windows for XenApp & XenDesktop before 11.2, Citrix Online Plug-in for Mac for XenApp & XenDesktop before 11.0, Citrix ICA Client for Linux before 11.100, Citrix ICA Client for Solaris before 8.63, and Citrix Receiver for…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.92%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Citrix Online Plug-in for Windows for XenApp & XenDesktop before 11.2, Citrix Online Plug-in for Mac for XenApp & XenDesktop before 11.0, Citrix ICA Client for Linux before 11.100, Citrix ICA Client for Solaris before 8.63, and Citrix Receiver for Windows Mobile before 11.5 allow remote attackers to execute arbitrary code via (1) a crafted HTML document, (2) a crafted .ICA file, or (3) a crafted type field in an ICA graphics packet, related to a "heap offset overflow" issue.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 4.92% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- citrix/ica client for linux · citrix/ica client for solaris · citrix/online plug-in for mac for xenapp \& xendesktop · citrix/online plug-in for windows for xenapp \& xendesktop · citrix/receiver for windows mobile
- Source
- cve@mitre.org
References
- http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0040.html
- http://secunia.com/advisories/40808Vendor Advisory
- http://support.citrix.com/article/CTX125975Patch, Vendor Advisory
- http://www.securityfocus.com/archive/1/512861/100/0/threaded
- http://archives.neohapsis.com/archives/fulldisclosure/2010-08/0040.html
- http://secunia.com/advisories/40808Vendor Advisory
- http://support.citrix.com/article/CTX125975Patch, Vendor Advisory
- http://www.securityfocus.com/archive/1/512861/100/0/threaded
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.