CVE-2012-0165 GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2 and Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1 does not properly validate record types in EMF images, which allows remote attacker...
HighCVSS 9.3
EPSS 25.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2 and Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1 does not properly validate record types in EMF images, which allows remote attackers to execute arbitrary code via a crafted image, aka "GDI+ Record Type Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft office | = 2003-sp3 | No fix listed |
| Microsoft office | = 2007-sp2 | No fix listed |
| Microsoft office | = 2007-sp3 | No fix listed |
| Microsoft office | = 2010 | No fix listed |
| Microsoft office | = 2010-sp1 | No fix listed |
| Microsoft windows server 2008 | All versions | No fix listed |
| Microsoft windows vista | All versions | No fix listed |
References
- 49121 third-party-advisory
- 53347 vdb-entry
- 1027038 vdb-entry
- TA12-129A third-party-advisory us-government-resource
- MS12-034 vendor-advisory
- windows-gdi-emf-code-exec(75125) vdb-entry
- oval:org.mitre.oval:def:15621 signature vdb-entry