Improper input validation in Microsoft Office
CVE-2012-0165
GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2 and Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1 does not properly validate record types in EMF images, which allows remote attackers to execute arbitrary code via a craft…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.621 (98.4th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Office — versions 2003, 2007, 2010
- Microsoft Windows_server_2008
- Microsoft Windows_vista
- N/a — versions n/a
Weakness classification (CWE)
References
- 49121 (x_refsource_SECUNIA, third-party-advisory)
- windows-gdi-emf-code-exec(75125) (vdb-entry, x_refsource_XF)
- 53347 (vdb-entry, x_refsource_BID)
- oval:org.mitre.oval:def:15621 (x_refsource_OVAL, signature, vdb-entry)
- MS12-034 (x_refsource_MS, vendor-advisory)
- 1027038 (vdb-entry, x_refsource_SECTRACK)
- TA12-129A (US Government Resource, x_refsource_CERT, third-party-advisory)