« Volver al listado

CVE-2010-2570

Estado: ModificadaAlta (9.3)—

Heap-based buffer overflow in pubconv.dll (aka the Publisher Converter DLL) in Microsoft Publisher 2002 SP3, 2003 SP3, 2007 SP2, and 2010 allows remote attackers to execute arbitrary code via a crafted Publisher file that uses an old file format, aka "Heap Overrun in pubconv.dll Vulnerability."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microsoft — Publisher

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2010-2570",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2010-12-16T19:33:02.100",
  "references": [
    {
      "url": "http://www.securitytracker.com/id?1024885",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-348A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-103",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12187",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1024885",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA10-348A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-103",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12187",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Heap-based buffer overflow in pubconv.dll (aka the Publisher Converter DLL) in Microsoft Publisher 2002 SP3, 2003 SP3, 2007 SP2, and 2010 allows remote attackers to execute arbitrary code via a crafted Publisher file that uses an old file format, aka \"Heap Overrun in pubconv.dll Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Desbordamiento de búfer basado en memoria dinámica  en pubconv.dll (también conocido como Publisher Converter DLL) en Microsoft Publisher 2002 SP3, 2003 SP3, 2007 SP2, y 2010, permite a atacantes remotos causar una denegación de servicio (cuelgue) o ejecutar código arbitrario a través de un fichero Publisher manipulado que usa un formato de fichero antiguo, también conocido como \"vulnerabilidad de rebasamiento del montón en pubconv.dll\""
    }
  ],
  "lastModified": "2026-06-16T23:21:00.310",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:publisher:2002:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71EF6E23-253B-4662-8599-11A518E6F426"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:publisher:2003:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C339302C-2A13-4869-A46A-AC43F5696D20"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:publisher:2007:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A885981E-709E-4272-8DC6-A8FED3B71BCF"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:publisher:2010:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "838B45A4-9A65-4B5F-A0F1-F4E6D23C91C0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}