CVE-2012-0165

GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2 and Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1 does not properly validate record types in EMF images, which allows remote attackers to execute arbitrary code via a crafted image, aka "GDI+ Record Type Vulnerability."
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:C/I:C/A:C
microsoftCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 98%
VendorProductVersion
microsoftwindows_server_2008
-
microsoftwindows_vista
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://secunia.com/advisories/49121
http://www.securityfocus.com/bid/53347
http://www.securitytracker.com/id?1027038
http://www.us-cert.gov/cas/techalerts/TA12-129A.html
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034
https://exchange.xforce.ibmcloud.com/vulnerabilities/75125
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15621
http://secunia.com/advisories/49121
http://www.securityfocus.com/bid/53347
http://www.securitytracker.com/id?1027038
http://www.us-cert.gov/cas/techalerts/TA12-129A.html
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034
https://exchange.xforce.ibmcloud.com/vulnerabilities/75125
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15621