« Volver al listado

CVE-2011-1982

Estado: ModificadaAlta (9.3)—

Microsoft Office 2007 SP2 y 2010 Gold y SP1, no inicializa un puntero a un objeto no especificado durante la apertura de documentos de Word, lo que permite a atacantes remotos ejecutar código de su elección mediante un documento debidamente modificado. Es un problema también conocido como "Vulnerabilidad de puntero no inicializado de Office".

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Microsoft — Office

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-1982",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-09-15T12:26:48.757",
  "references": [
    {
      "url": "http://www.kb.cert.org/vuls/id/909022",
      "tags": [
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA11-256A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-073",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12243",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/909022",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA11-256A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-073",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12243",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Office 2007 SP2, and 2010 Gold and SP1, does not initialize an unspecified object pointer during the opening of Word documents, which allows remote attackers to execute arbitrary code via a crafted document, aka \"Office Uninitialized Object Pointer Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Microsoft Office 2007 SP2 y 2010 Gold y SP1, no inicializa un puntero a un objeto no especificado durante la apertura de documentos de Word, lo que permite a atacantes remotos ejecutar código de su elección mediante un documento debidamente modificado. Es un problema también conocido como \"Vulnerabilidad de puntero no inicializado de Office\"."
    }
  ],
  "lastModified": "2026-06-16T23:30:32.683",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08AF794A-435D-4171-9DBB-EB7FAED96DBA"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:*:x32:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9AC0BEF9-2417-48C5-BC95-F95F41F08795"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:*:x64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C60D2557-347B-41BD-91D5-A51C88630B73"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:sp1:x32:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C91F1A74-BE24-4EF7-8E3B-E5E6448E7E40"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:sp1:x64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8239CEF1-BD02-4ACE-A0C2-75A9EAA15914"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}