« Volver al listado

CVE-2011-1972

Estado: ModificadaAlta (9.3)—

Microsoft Visio 2003 SP3, 2007 SP2, and 2010 Gold and SP1 does not properly validate objects in memory during Visio file parsing, which allows remote attackers to execute arbitrary code via a crafted file, aka "pStream Release RCE Vulnerability."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microsoft — Visio

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-1972",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-08-10T21:55:01.860",
  "references": [
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA11-221A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-060",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12852",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA11-221A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-060",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12852",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Visio 2003 SP3, 2007 SP2, and 2010 Gold and SP1 does not properly validate objects in memory during Visio file parsing, which allows remote attackers to execute arbitrary code via a crafted file, aka \"pStream Release RCE Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Microsoft Visio 2003 SP3, 2007 SP2 y 2010 Gold y SP1 no valida adecuadamente los objetos en memoria durante el análisis sintáctico del fichero Visio, esto permite a atacantes remotos ejecutar código de su elección mediante un fichero manipulado. También se conoce como \"Vulnerabildiad en pStream Release RCE\"."
    }
  ],
  "lastModified": "2026-06-16T23:30:31.810",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:visio:2003:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "553ADEFC-11EC-4E29-8A95-4AF59DB6CEAE"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visio:2007:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E822A55C-0440-4622-9284-A5DF70D49C63"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visio:2010:*:x32:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6FD08D8C-C7B8-41CB-8F21-F894704330B0"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visio:2010:*:x64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C029E0B6-9E53-409A-BAFF-5A2F17AB14AD"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visio:2010:sp1:x32:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB6C963E-46DA-422C-9DE7-B0536F001C5E"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visio:2010:sp1:x64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1AA1633F-11EA-42E1-A4C7-7334E8EF8486"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}