CVE-2012-0020
Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability,"…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 20.3%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability than CVE-2012-0019, CVE-2012-0136, CVE-2012-0137, and CVE-2012-0138.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 20.29% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- microsoft/visio viewer
- Source
- secure@microsoft.com
References
- http://www.us-cert.gov/cas/techalerts/TA12-045A.htmlThird Party Advisory, US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-015
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14965
- http://www.us-cert.gov/cas/techalerts/TA12-045A.htmlThird Party Advisory, US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-015
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14965
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.