CVE-2012-1889 Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via...
HighCVSS 8.8
EPSS 83.5%
CISA KEV
added 2022-06-08 · due 2022-06-22
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
CISA Known Exploited Vulnerability
- Date added
- 2022-06-08
- Due date (FCEB)
- 2022-06-22
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft xml core services | = 3.0 | No fix listed |
| Microsoft xml core services | = 4.0 | No fix listed |
| Microsoft xml core services | = 6.0 | No fix listed |
| Microsoft xml core services | = 5.0 | No fix listed |
References
- technet.microsoft.com vendor-advisory
- TA12-174A third-party-advisory us-government-resource
- TA12-192A third-party-advisory us-government-resource
- MS12-043 patch vendor-advisory
- oval:org.mitre.oval:def:15195 broken-link signature vdb-entry
- www.cisa.gov government-resource us-government-resource