CVE-2011-0093
ELEMENTS.DLL in Microsoft Visio 2002 SP2, 2003 SP3, and 2007 SP2 does not properly parse structures during the opening of a Visio file, which allows remote attackers to execute arbitrary code via a file containing a malformed structure, aka "Visio Data…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 19.5%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
ELEMENTS.DLL in Microsoft Visio 2002 SP2, 2003 SP3, and 2007 SP2 does not properly parse structures during the opening of a Visio file, which allows remote attackers to execute arbitrary code via a file containing a malformed structure, aka "Visio Data Type Memory Corruption Vulnerability."
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 19.54% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- microsoft/visio
- Source
- secure@microsoft.com
References
- http://osvdb.org/70829
- http://secunia.com/advisories/43254
- http://www.securityfocus.com/bid/46138
- http://www.securitytracker.com/id?1025043
- http://www.vupen.com/english/advisories/2011/0321
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-008
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64924
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12469
- http://osvdb.org/70829
- http://secunia.com/advisories/43254
- http://www.securityfocus.com/bid/46138
- http://www.securitytracker.com/id?1025043
- http://www.vupen.com/english/advisories/2011/0321
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-008
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64924
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12469
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.