RCE in Citrix Online Plug-In For Windows Xenapp \& Xendesktop
CVE-2010-2991
The IICAClient interface in the ICAClient library in the ICA Client ActiveX Object (aka ICO) component in Citrix Online Plug-in for Windows for XenApp & XenDesktop before 12.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HTML document that triggers the reading of a .ICA file.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.068 (93.3th percentile) — read the EPSS interpretation.
Affected products
- Citrix Online_plug-in_for_windows_for_xenapp_\&_xendesktop — versions 11.1
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (x_refsource_IDEFENSE, third-party-advisory)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- cve@mitre.org (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)