CVE-2014-3802 msdia.dll in Microsoft Debug Interface Access (DIA) SDK, as distributed in Microsoft Visual Studio before 2013, does not properly validate an unspecified variable before use in calculating a dynamic-c...
MediumCVSS 6.8
EPSS 10.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
msdia.dll in Microsoft Debug Interface Access (DIA) SDK, as distributed in Microsoft Visual Studio before 2013, does not properly validate an unspecified variable before use in calculating a dynamic-call address, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDB file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft debug interface access software development kit | All versions | No fix listed |
| Microsoft visual studio | <= 2012 | No fix listed |
| Microsoft visual studio | = 2002 | No fix listed |
| Microsoft visual studio | = 2003 | No fix listed |
| Microsoft visual studio | = 2005 | No fix listed |
| Microsoft visual studio | = 2010 | No fix listed |
| Microsoft visual studio | = 2010-sp1 | No fix listed |
References
- 67398 third-party-advisory vdb-entry
- zerodayinitiative.com third-party-advisory vdb-entry