ByteOS Network

Vulnerability Details :

CVE-2012-0159

Assigner Org ID-f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At-09 May, 2012 | 00:00

Updated At-06 Aug, 2024 | 18:16

Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview; Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Silverlight 4 before 4.1.10329; and Silverlight 5 before 5.1.10411 allow remote attackers to execute arbitrary code via a crafted TrueType font (TTF) file, aka "TrueType Font Parsing Vulnerability."

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:microsoft

Assigner Org ID:f38d906d-7342-40ea-92c1-6c4a2c6478c8

Published At:09 May, 2012 | 00:00

Updated At:06 Aug, 2024 | 18:16

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://secunia.com/advisories/49121	third-party-advisory x_refsource_SECUNIA
http://www.us-cert.gov/cas/techalerts/TA12-164A.html	third-party-advisory x_refsource_CERT
http://www.securitytracker.com/id?1027039	vdb-entry x_refsource_SECTRACK
http://secunia.com/advisories/49122	third-party-advisory x_refsource_SECUNIA
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15667	vdb-entry signature x_refsource_OVAL
http://www.securityfocus.com/bid/53335	vdb-entry x_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilities/75124	vdb-entry x_refsource_XF
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034	vendor-advisory x_refsource_MS
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039	vendor-advisory x_refsource_MS
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15388	vdb-entry signature x_refsource_OVAL
http://www.us-cert.gov/cas/techalerts/TA12-129A.html	third-party-advisory x_refsource_CERT

Hyperlink: http://secunia.com/advisories/49121

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-164A.html

Resource:

third-party-advisory

x_refsource_CERT

Hyperlink: http://www.securitytracker.com/id?1027039

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: http://secunia.com/advisories/49122

Resource:

third-party-advisory

x_refsource_SECUNIA

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15667

Resource:

vdb-entry

signature

x_refsource_OVAL

Hyperlink: http://www.securityfocus.com/bid/53335

Resource:

vdb-entry

x_refsource_BID

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/75124

Resource:

vdb-entry

x_refsource_XF

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034

Resource:

vendor-advisory

x_refsource_MS

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039

Resource:

vendor-advisory

x_refsource_MS

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15388

Resource:

vdb-entry

signature

x_refsource_OVAL

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-129A.html

Resource:

third-party-advisory

x_refsource_CERT

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://secunia.com/advisories/49121	third-party-advisory x_refsource_SECUNIA x_transferred
http://www.us-cert.gov/cas/techalerts/TA12-164A.html	third-party-advisory x_refsource_CERT x_transferred
http://www.securitytracker.com/id?1027039	vdb-entry x_refsource_SECTRACK x_transferred
http://secunia.com/advisories/49122	third-party-advisory x_refsource_SECUNIA x_transferred
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15667	vdb-entry signature x_refsource_OVAL x_transferred
http://www.securityfocus.com/bid/53335	vdb-entry x_refsource_BID x_transferred
https://exchange.xforce.ibmcloud.com/vulnerabilities/75124	vdb-entry x_refsource_XF x_transferred
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034	vendor-advisory x_refsource_MS x_transferred
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039	vendor-advisory x_refsource_MS x_transferred
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15388	vdb-entry signature x_refsource_OVAL x_transferred
http://www.us-cert.gov/cas/techalerts/TA12-129A.html	third-party-advisory x_refsource_CERT x_transferred

Hyperlink: http://secunia.com/advisories/49121

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-164A.html

Resource:

third-party-advisory

x_refsource_CERT

x_transferred

Hyperlink: http://www.securitytracker.com/id?1027039

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: http://secunia.com/advisories/49122

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15667

Resource:

vdb-entry

signature

x_refsource_OVAL

x_transferred

Hyperlink: http://www.securityfocus.com/bid/53335

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/75124

Resource:

vdb-entry

x_refsource_XF

x_transferred

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034

Resource:

vendor-advisory

x_refsource_MS

x_transferred

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039

Resource:

vendor-advisory

x_refsource_MS

x_transferred

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15388

Resource:

vdb-entry

signature

x_refsource_OVAL

x_transferred

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-129A.html

Resource:

third-party-advisory

x_refsource_CERT

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secure@microsoft.com

Published At:09 May, 2012 | 00:55

Updated At:11 Apr, 2025 | 00:51

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C

Type: Primary

Version: 2.0

Base score: 9.3

Base severity: HIGH

Vector:

AV:N/AC:M/Au:N/C:C/I:C/A:C

CPE Matches

Microsoft Corporation

>>office>>2003

cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*

Microsoft Corporation

>>office>>2007

cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*

Microsoft Corporation

>>office>>2007

cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*

Microsoft Corporation

>>office>>2010

cpe:2.3:a:microsoft:office:2010:*:*:*:*:*:*:*

Microsoft Corporation

>>office>>2010

cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:*:*

Microsoft Corporation

>>windows_7>>*

cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_7>>-

cpe:2.3:o:microsoft:windows_7:-:sp1:x64:*:*:*:*:*

Microsoft Corporation

>>windows_7>>-

cpe:2.3:o:microsoft:windows_7:-:sp1:x86:*:*:*:*:*

Microsoft Corporation

>>windows_8>>consumer_preview

cpe:2.3:o:microsoft:windows_8:consumer_preview:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_server_2008>>*

cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*

Microsoft Corporation

>>windows_server_2008>>r2

cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*

Microsoft Corporation

>>windows_server_2008>>r2

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*

Microsoft Corporation

>>windows_vista>>-

cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

Microsoft Corporation

>>windows_xp>>*

cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*

Microsoft Corporation

>>windows_xp>>*

cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*

Microsoft Corporation

>>silverlight>>4.0.50401.0

cpe:2.3:a:microsoft:silverlight:4.0.50401.0:*:*:*:*:*:*:*

Microsoft Corporation

>>silverlight>>4.0.50524.00

cpe:2.3:a:microsoft:silverlight:4.0.50524.00:*:*:*:*:*:*:*

Microsoft Corporation

>>silverlight>>4.0.50826.0

cpe:2.3:a:microsoft:silverlight:4.0.50826.0:*:*:*:*:*:*:*

Microsoft Corporation

>>silverlight>>4.0.50917.0

cpe:2.3:a:microsoft:silverlight:4.0.50917.0:*:*:*:*:*:*:*

Microsoft Corporation

>>silverlight>>4.0.51204.0

cpe:2.3:a:microsoft:silverlight:4.0.51204.0:*:*:*:*:*:*:*

Microsoft Corporation

>>silverlight>>4.0.60129.0

cpe:2.3:a:microsoft:silverlight:4.0.60129.0:*:*:*:*:*:*:*

Microsoft Corporation

>>silverlight>>4.0.60310.0

cpe:2.3:a:microsoft:silverlight:4.0.60310.0:*:*:*:*:*:*:*

Microsoft Corporation

>>silverlight>>4.0.60531.0

cpe:2.3:a:microsoft:silverlight:4.0.60531.0:*:*:*:*:*:*:*

Microsoft Corporation

>>silverlight>>4.0.60831.0

cpe:2.3:a:microsoft:silverlight:4.0.60831.0:*:*:*:*:*:*:*

Microsoft Corporation

>>silverlight>>4.1.10111.0

cpe:2.3:a:microsoft:silverlight:4.1.10111.0:*:*:*:*:*:*:*

Microsoft Corporation

>>silverlight>>5.0.60401.0

cpe:2.3:a:microsoft:silverlight:5.0.60401.0:*:*:*:*:*:*:*

Microsoft Corporation

>>silverlight>>5.0.60818.0

cpe:2.3:a:microsoft:silverlight:5.0.60818.0:rc:*:*:*:*:*:*

Microsoft Corporation

>>silverlight>>5.0.61118.0

cpe:2.3:a:microsoft:silverlight:5.0.61118.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-399	Primary	nvd@nist.gov

CWE ID: CWE-399

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://secunia.com/advisories/49121	secure@microsoft.com	N/A
http://secunia.com/advisories/49122	secure@microsoft.com	N/A
http://www.securityfocus.com/bid/53335	secure@microsoft.com	N/A
http://www.securitytracker.com/id?1027039	secure@microsoft.com	N/A
http://www.us-cert.gov/cas/techalerts/TA12-129A.html	secure@microsoft.com	US Government Resource
http://www.us-cert.gov/cas/techalerts/TA12-164A.html	secure@microsoft.com	US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034	secure@microsoft.com	N/A
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039	secure@microsoft.com	N/A
https://exchange.xforce.ibmcloud.com/vulnerabilities/75124	secure@microsoft.com	N/A
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15388	secure@microsoft.com	N/A
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15667	secure@microsoft.com	N/A
http://secunia.com/advisories/49121	af854a3a-2127-422b-91ae-364da2661108	N/A
http://secunia.com/advisories/49122	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securityfocus.com/bid/53335	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.securitytracker.com/id?1027039	af854a3a-2127-422b-91ae-364da2661108	N/A
http://www.us-cert.gov/cas/techalerts/TA12-129A.html	af854a3a-2127-422b-91ae-364da2661108	US Government Resource
http://www.us-cert.gov/cas/techalerts/TA12-164A.html	af854a3a-2127-422b-91ae-364da2661108	US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034	af854a3a-2127-422b-91ae-364da2661108	N/A
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039	af854a3a-2127-422b-91ae-364da2661108	N/A
https://exchange.xforce.ibmcloud.com/vulnerabilities/75124	af854a3a-2127-422b-91ae-364da2661108	N/A
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15388	af854a3a-2127-422b-91ae-364da2661108	N/A
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15667	af854a3a-2127-422b-91ae-364da2661108	N/A

Hyperlink: http://secunia.com/advisories/49121

Source: secure@microsoft.com

Resource: N/A

Hyperlink: http://secunia.com/advisories/49122

Source: secure@microsoft.com

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/53335

Source: secure@microsoft.com

Resource: N/A

Hyperlink: http://www.securitytracker.com/id?1027039

Source: secure@microsoft.com

Resource: N/A

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-129A.html

Source: secure@microsoft.com

Resource:

US Government Resource

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-164A.html

Source: secure@microsoft.com

Resource:

US Government Resource

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034

Source: secure@microsoft.com

Resource: N/A

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039

Source: secure@microsoft.com

Resource: N/A

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/75124

Source: secure@microsoft.com

Resource: N/A

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15388

Source: secure@microsoft.com

Resource: N/A

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15667

Source: secure@microsoft.com

Resource: N/A

Hyperlink: http://secunia.com/advisories/49121

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://secunia.com/advisories/49122

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securityfocus.com/bid/53335

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.securitytracker.com/id?1027039

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-129A.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

US Government Resource

Hyperlink: http://www.us-cert.gov/cas/techalerts/TA12-164A.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

US Government Resource

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/75124

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15388

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Hyperlink: https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15667

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Similar CVEs

3425Records found

CVE-2010-2205

Matching Score-8

Assigner-Adobe Systems Incorporated

View Details

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.3||HIGH

EPSS-7.95% / 91.89%

7 Day CHG~0.00%

Published-30 Jun, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, access uninitialized memory, which allows attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2010-2210

Matching Score-8

Assigner-Adobe Systems Incorporated

View Details

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.3||HIGH

EPSS-3.52% / 87.39%

7 Day CHG~0.00%

Published-30 Jun, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-1295, CVE-2010-2202, CVE-2010-2207, CVE-2010-2209, CVE-2010-2211, and CVE-2010-2212.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-0255

Matching Score-8

Assigner-Apple Inc.

View Details

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-4.02% / 88.24%

7 Day CHG~0.00%

Published-21 Jul, 2011 | 23:00

Updated-11 Apr, 2025 | 00:51

WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2011-07-20-1.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-0225

Matching Score-8

Assigner-Apple Inc.

View Details

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-4.02% / 88.24%

7 Day CHG~0.00%

Published-21 Jul, 2011 | 23:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-0221

Matching Score-8

Assigner-Apple Inc.

View Details

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-4.02% / 88.24%

7 Day CHG~0.00%

Published-21 Jul, 2011 | 23:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-0624

Matching Score-8

Assigner-Adobe Systems Incorporated

View Details

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.3||HIGH

EPSS-4.49% / 88.88%

7 Day CHG~0.00%

Published-13 May, 2011 | 22:00

Updated-11 Apr, 2025 | 00:51

Adobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows attackers to execute arbitrary code via unspecified vectors, related to a "bounds checking" issue, a different vulnerability than CVE-2011-0623, CVE-2011-0625, and CVE-2011-0626.

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Oracle Corporation Apple Inc.Adobe Inc.

Product-linux_kernel windows solaris android flash_player mac_os_x n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2010-2559

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-52.82% / 97.88%

7 Day CHG~0.00%

Published-11 Aug, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly initialized or (2) is deleted, leading to memory corruption, aka "Uninitialized Memory Corruption Vulnerability," a different vulnerability than CVE-2009-3671, CVE-2009-3674, CVE-2010-0245, and CVE-2010-0246.

Vendor-n/a Microsoft Corporation

Product-windows_7 windows_xp windows_server_2008 windows_server_2003 windows_vista internet_explorer n/a

CWE ID-CWE-908

Use of Uninitialized Resource

CVE-2011-0223

Matching Score-8

Assigner-Apple Inc.

View Details

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-2.04% / 83.57%

7 Day CHG~0.00%

Published-21 Jul, 2011 | 23:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-2748

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-54.35% / 97.96%

7 Day CHG~0.00%

Published-13 Oct, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Microsoft Word 2002 SP3 and Office 2004 for Mac do not properly check an unspecified boundary during parsing of a Word document, which allows remote attackers to execute arbitrary code via a crafted document that triggers memory corruption, aka "Word Boundary Check Vulnerability."

Vendor-n/a Microsoft Corporation

Product-word office n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2011-0247

Matching Score-8

Assigner-Apple Inc.

View Details

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-7.90% / 91.86%

7 Day CHG~0.00%

Published-04 Aug, 2011 | 01:00

Updated-11 Apr, 2025 | 00:51

Multiple stack-based buffer overflows in Apple QuickTime before 7.7 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted H.264 movie.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 windows_xp quicktime windows_vista n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-2572

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-7.8||HIGH

EPSS-74.72% / 98.83%

7 Day CHG~0.00%

Published-10 Nov, 2010 | 01:00

Updated-22 Oct, 2025 | 01:15

Known KEV||Action Due Date - 2022-06-22||Apply updates per vendor instructions.

Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95 document, aka "PowerPoint Parsing Buffer Overflow Vulnerability."

Vendor-n/a Microsoft Corporation

Product-powerpoint n/a PowerPoint

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2010-1902

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-58.30% / 98.14%

7 Day CHG~0.00%

Published-11 Aug, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP2; Microsoft Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Word Viewer; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code via unspecified properties in the data in a crafted RTF document, aka "Word RTF Parsing Buffer Overflow Vulnerability."

Vendor-n/a Microsoft Corporation

Product-office open_xml_file_format_converter word office_compatibility_pack office_word_viewer n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-0620

Matching Score-8

Assigner-Adobe Systems Incorporated

View Details

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.3||HIGH

EPSS-5.70% / 90.24%

7 Day CHG~0.00%

Published-13 May, 2011 | 22:00

Updated-11 Apr, 2025 | 00:51

Adobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2011-0619, CVE-2011-0621, and CVE-2011-0622.

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Oracle Corporation Apple Inc.Adobe Inc.

Product-linux_kernel windows solaris android flash_player mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-0619

Matching Score-8

Assigner-Adobe Systems Incorporated

View Details

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.3||HIGH

EPSS-5.70% / 90.24%

7 Day CHG~0.00%

Published-13 May, 2011 | 22:00

Updated-11 Apr, 2025 | 00:51

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Oracle Corporation Apple Inc.Adobe Inc.

Product-linux_kernel windows solaris android flash_player mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2011-0585

Matching Score-8

Assigner-Adobe Systems Incorporated

View Details

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.3||HIGH

EPSS-1.68% / 81.91%

7 Day CHG~0.00%

Published-10 Feb, 2011 | 17:00

Updated-11 Apr, 2025 | 00:51

Unspecified vulnerability in Adobe Reader and Acrobat 10.x before 10.0.1, 9.x before 9.4.2, and 8.x before 8.2.6 on Windows and Mac OS X allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2011-0565.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CVE-2010-1880

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-59.83% / 98.22%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 22:00

Updated-11 Apr, 2025 | 00:51

Unspecified vulnerability in Quartz.dll for DirectShow on Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista SP1, and Server 2008 allows remote attackers to execute arbitrary code via a media file with crafted compression data, aka "MJPEG Media Decompression Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_2003_server windows_xp windows_server_2008 windows_2000 directx windows_vista n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2010-1799

Matching Score-8

Assigner-Apple Inc.

View Details

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-67.68% / 98.54%

7 Day CHG~0.00%

Published-16 Aug, 2010 | 18:25

Updated-11 Apr, 2025 | 00:51

Stack-based buffer overflow in the error-logging functionality in Apple QuickTime before 7.6.7 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows quicktime n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1281

Matching Score-8

Assigner-Adobe Systems Incorporated

View Details

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-14.07% / 94.20%

7 Day CHG~0.00%

Published-13 May, 2010 | 17:00

Updated-11 Apr, 2025 | 00:51

iml32.dll in Adobe Shockwave Player before 11.5.7.609 does not validate a certain value from a file before using it in file-pointer calculations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted .dir (aka Director) file.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows shockwave_player macos n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2010-1250

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-62.41% / 98.32%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Heap-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file with malformed (1) EDG (0x88) and (2) Publisher (0x89) records, aka "Excel EDG Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-open_xml_file_format_converter office excel n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2010-1288

Matching Score-8

Assigner-Adobe Systems Incorporated

View Details

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.3||HIGH

EPSS-7.68% / 91.74%

7 Day CHG~0.00%

Published-13 May, 2010 | 21:00

Updated-11 Apr, 2025 | 00:51

Buffer overflow in Adobe Shockwave Player before 11.5.7.609 might allow attackers to execute arbitrary code via unspecified vectors.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows windows_7 shockwave_player windows_server_2008 windows_server_2003 windows_vista macos n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1788

Matching Score-8

Assigner-Apple Inc.

View Details

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-7.11% / 91.36%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a use element in an SVG document.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1903

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-55.12% / 97.99%

7 Day CHG~0.00%

Published-11 Aug, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Microsoft Office Word 2002 SP3 and 2003 SP3, and Office Word Viewer, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a malformed record in a Word file, aka "Word HTML Linked Objects Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-word office_word_viewer n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2010-1285

Matching Score-8

Assigner-Adobe Systems Incorporated

View Details

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.3||HIGH

EPSS-7.70% / 91.74%

7 Day CHG~0.00%

Published-30 Jun, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code via unspecified manipulations involving the newclass (0x58) operator and an "invalid pointer vulnerability" that triggers memory corruption, a different vulnerability than CVE-2010-2168 and CVE-2010-2201.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2010-1403

Matching Score-8

Assigner-Apple Inc.

View Details

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-11.05% / 93.29%

7 Day CHG~0.00%

Published-11 Jun, 2010 | 17:28

Updated-11 Apr, 2025 | 00:51

WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, accesses uninitialized memory during the handling of a use element in an SVG document, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted document containing XML that triggers a parsing error, related to ProcessInstruction.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-1297

Matching Score-8

Assigner-Adobe Systems Incorporated

View Details

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-93.39% / 99.81%

7 Day CHG~0.00%

Published-08 Jun, 2010 | 18:00

Updated-22 Oct, 2025 | 01:15

Known KEV||Action Due Date - 2022-06-22||The impacted product is end-of-life and should be disconnected if still in use.

Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64; Adobe AIR before 2.0.2.12610; and Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, related to authplay.dll and the ActionScript Virtual Machine 2 (AVM2) newfunction instruction, as exploited in the wild in June 2010.

Vendor-n/a SUSE Microsoft Corporation openSUSE Apple Inc.Adobe Inc.

Product-mac_os_x flash_player air windows opensuse linux_enterprise acrobat n/a Flash Player

CWE ID-CWE-787

Out-of-bounds Write

CVE-2010-5082

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-44.27% / 97.46%

7 Day CHG+0.95%

Published-17 Jan, 2012 | 19:00

Updated-11 Apr, 2025 | 00:51

Untrusted search path vulnerability in colorcpl.exe 6.0.6000.16386 in the Color Control Panel in Microsoft Windows Server 2008 SP2, R2, and R2 SP1 allows local users to gain privileges via a Trojan horse sti.dll file in the current working directory, as demonstrated by a directory that contains a .camp, .cdmp, .gmmp, .icc, or .icm file, aka "Color Control Panel Insecure Library Loading Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_server_2008 n/a

CVE-2010-1786

Matching Score-8

Assigner-Apple Inc.

View Details

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-7.06% / 91.32%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a foreignObject element in an SVG document.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CVE-2010-1785

Matching Score-8

Assigner-Apple Inc.

View Details

Matching Score-8

Assigner-Apple Inc.

CVSS Score-9.3||HIGH

EPSS-8.20% / 92.03%

7 Day CHG~0.00%

Published-30 Jul, 2010 | 20:00

Updated-11 Apr, 2025 | 00:51

WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; accesses uninitialized memory during processing of the (1) :first-letter and (2) :first-line pseudo-elements in an SVG text element, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted document.

Vendor-n/a Microsoft Corporation Apple Inc.

Product-windows_7 webkit windows_xp windows_vista safari mac_os_x mac_os_x_server n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-0491

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-62.43% / 98.32%

7 Day CHG~0.00%

Published-31 Mar, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Use-after-free vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 6 SP1 allows remote attackers to execute arbitrary code by changing unspecified properties of an HTML object that has an onreadystatechange event handler, aka "HTML Object Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_xp windows_server_2003 windows_2000 windows_2003_server internet_explorer n/a

CVE-2010-0192

Matching Score-8

Assigner-Adobe Systems Incorporated

View Details

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.3||HIGH

EPSS-41.09% / 97.30%

7 Day CHG~0.00%

Published-14 Apr, 2010 | 15:44

Updated-11 Apr, 2025 | 00:51

Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X, allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2010-0193 and CVE-2010-0196.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows acrobat_reader acrobat mac_os_x n/a

CVE-2010-0487

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-33.75% / 96.85%

7 Day CHG~0.00%

Published-14 Apr, 2010 | 15:44

Updated-11 Apr, 2025 | 00:51

The Authenticode Signature verification functionality in cabview.dll in Cabinet File Viewer Shell Extension 5.1, 6.0, and 6.1 in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly use unspecified fields in a file digest, which allows remote attackers to execute arbitrary code via a modified cabinet (aka .CAB) file that incorrectly appears to have a valid signature, aka "Cabview Corruption Validation Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_7 windows_xp windows_server_2008 windows_server_2003 windows_2000 windows_2003_server windows_vista n/a

CWE ID-CWE-20

Improper Input Validation

CVE-2010-0116

Matching Score-8

Assigner-Flexera Software LLC

View Details

Matching Score-8

Assigner-Flexera Software LLC

CVSS Score-9.3||HIGH

EPSS-12.53% / 93.79%

7 Day CHG~0.00%

Published-30 Aug, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Integer overflow in RealNetworks RealPlayer 11.0 through 11.1 and RealPlayer SP 1.0 through 1.1.4 on Windows might allow remote attackers to execute arbitrary code via a crafted QCP file that triggers a heap-based buffer overflow.

Vendor-n/a RealNetworks LLC Microsoft Corporation

Product-realplayer_sp windows realplayer n/a

CVE-2010-0250

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-71.11% / 98.67%

7 Day CHG~0.00%

Published-10 Feb, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Heap-based buffer overflow in DirectShow in Microsoft DirectX, as used in the AVI Filter on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2, and in Quartz on Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, allows remote attackers to execute arbitrary code via an AVI file with a crafted length field in an unspecified video stream, which is not properly handled by the RLE video decompressor, aka "DirectShow Heap Overflow Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_7 windows_xp windows_server_2008 windows_vista n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-0480

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-83.49% / 99.26%

7 Day CHG~0.00%

Published-14 Apr, 2010 | 15:44

Updated-11 Apr, 2025 | 00:51

Multiple stack-based buffer overflows in the MPEG Layer-3 audio codecs in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allow remote attackers to execute arbitrary code via a crafted AVI file, aka "MPEG Layer-3 Audio Decoder Stack Overflow Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_xp windows_server_2008 windows_server_2003 windows_2000 windows_2003_server windows_vista n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-0257

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-58.32% / 98.15%

7 Day CHG~0.00%

Published-10 Mar, 2010 | 22:00

Updated-11 Apr, 2025 | 00:51

Microsoft Office Excel 2002 SP3 does not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Microsoft Office Excel Record Memory Corruption Vulnerability."

Vendor-n/a Microsoft Corporation

Product-office office_excel_viewer excel open_xml_file_format_converter office_compatibility_pack office_sharepoint_server n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2010-0127

Matching Score-8

Assigner-Flexera Software LLC

View Details

Matching Score-8

Assigner-Flexera Software LLC

CVSS Score-8.8||HIGH

EPSS-14.03% / 94.19%

7 Day CHG~0.00%

Published-13 May, 2010 | 17:00

Updated-11 Apr, 2025 | 00:51

Adobe Shockwave Player before 11.5.7.609 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted FFFFFF45h Shockwave 3D blocks in a Shockwave file.

Vendor-n/a Microsoft Corporation Apple Inc.Adobe Inc.

Product-windows shockwave_player macos n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2010-4588

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-65.64% / 98.46%

7 Day CHG~0.00%

Published-23 Dec, 2010 | 17:00

Updated-11 Apr, 2025 | 00:51

The WBEMSingleView.ocx ActiveX control 1.50.1131.0 in Microsoft WMI Administrative Tools 1.1 and earlier allows remote attackers to execute arbitrary code via a crafted argument to the ReleaseContext method, a different vector than CVE-2010-3973, possibly an untrusted pointer dereference.

Vendor-n/a Microsoft Corporation

Product-wmi_administrative_tools n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2010-0018

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-68.95% / 98.59%

7 Day CHG~0.00%

Published-13 Jan, 2010 | 19:00

Updated-07 Aug, 2024 | 00:37

Integer overflow in the Embedded OpenType (EOT) Font Engine (t2embed.dll) in Microsoft Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code via compressed data that represents a crafted EOT font, aka "Microtype Express Compressed Fonts Integer Flaw in the LZCOMP Decompressor Vulnerability."

Vendor-n/a Microsoft Corporation

Product-windows_vista windows_server_2008 windows_2003_server windows_xp windows_7 windows_2000 n/a

CWE ID-CWE-189

Not Available

CVE-2009-4242

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-12.60% / 93.81%

7 Day CHG~0.00%

Published-25 Jan, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Heap-based buffer overflow in the CGIFCodec::GetPacketBuffer function in datatype/image/gif/common/gifcodec.cpp in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via a GIF file with crafted chunk sizes that trigger improper memory allocation.

Vendor-n/a RealNetworks LLC Microsoft Corporation Apple Inc.

Product-realplayer_sp realplayer_enterprise windows realplayer helix_player mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2009-4210

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-24.04% / 95.92%

7 Day CHG~0.00%

Published-13 Dec, 2009 | 01:00

Updated-07 Aug, 2024 | 06:54

The Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted media content.

Vendor-n/a Microsoft Corporation

Product-windows_2003_server windows_xp windows_2000 n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-4257

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-10.84% / 93.22%

7 Day CHG~0.00%

Published-25 Jan, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Heap-based buffer overflow in datatype/smil/common/smlpkt.cpp in smlrender.dll in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10 and 11.0.0, and Helix Player 10.x and 11.0.0 allows remote attackers to execute arbitrary code via an SMIL file with crafted string lengths.

Vendor-n/a RealNetworks LLC Microsoft Corporation Apple Inc.

Product-realplayer_sp realplayer_enterprise windows realplayer helix_player mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2009-4244

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-6.59% / 90.97%

7 Day CHG~0.00%

Published-25 Jan, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Heap-based buffer overflow in RealNetworks RealPlayer 10; RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741; RealPlayer 11 11.0.0 through 11.0.4; RealPlayer Enterprise; Mac RealPlayer 10, 10.1, and 11.0; Linux RealPlayer 10; and Helix Player 10.x allows remote attackers to execute arbitrary code via an SIPR codec field with a small length value that triggers incorrect memory allocation.

Vendor-n/a RealNetworks LLC Microsoft Corporation Apple Inc.

Product-realplayer_sp realplayer_enterprise windows realplayer helix_player mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-4587

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-0.57% / 68.30%

7 Day CHG~0.00%

Published-22 Dec, 2010 | 01:00

Updated-11 Apr, 2025 | 00:51

Opera before 11.00 on Windows does not properly implement the Insecure Third Party Module warning message, which might make it easier for user-assisted remote attackers to have an unspecified impact via a crafted module.

Vendor-n/a Microsoft Corporation Opera

Product-windows opera_browser n/a

CVE-2009-4324

Matching Score-8

Assigner-Adobe Systems Incorporated

View Details

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-93.01% / 99.78%

7 Day CHG~0.00%

Published-15 Dec, 2009 | 02:00

Updated-22 Oct, 2025 | 01:15

Known KEV||Action Due Date - 2022-06-22||Apply updates per vendor instructions.

Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.

Vendor-n/a SUSE Microsoft Corporation openSUSE Apple Inc.Adobe Inc.

Product-mac_os_x windows opensuse linux_enterprise linux_enterprise_debuginfo acrobat acrobat_reader n/a Acrobat and Reader

CWE ID-CWE-416

Use After Free

CVE-2010-4314

Matching Score-8

Assigner-OpenText (formerly Micro Focus)

View Details

Matching Score-8

Assigner-OpenText (formerly Micro Focus)

CVSS Score-8.8||HIGH

EPSS-2.02% / 83.50%

7 Day CHG~0.00%

Published-11 Mar, 2017 | 06:46

Updated-20 Apr, 2025 | 01:37

Remote attackers can use the iPrint web-browser ActiveX plugin in Novell iPrint Client before 5.42 for Windows XP/Vista/Win7 to execute code by overflowing the "name" parameter.

Vendor-n/a Microsoft Corporation Novell

Product-windows_7 iprint windows_vista windows_xp Novell iPrint webrowser ActiveX plugin

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2009-4311

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-25.39% / 96.09%

7 Day CHG~0.00%

Published-13 Dec, 2009 | 01:00

Updated-07 Aug, 2024 | 07:01

Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted media content, as reported to Microsoft by Paul Byrne of NGS Software. NOTE: this might overlap CVE-2008-3615.

Vendor-n/a Microsoft Corporation

Product-windows_2003_server windows_xp windows_2000 n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CVE-2009-4245

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-7.36% / 91.54%

7 Day CHG~0.00%

Published-25 Jan, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

Heap-based buffer overflow in RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a compressed GIF file, related to gifcodec.cpp and gifimage.cpp.

Vendor-n/a RealNetworks LLC Microsoft Corporation Apple Inc.

Product-realplayer_sp realplayer_enterprise windows realplayer helix_player mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-0030

Matching Score-8

Assigner-Microsoft Corporation

View Details

Matching Score-8

Assigner-Microsoft Corporation

CVSS Score-9.3||HIGH

EPSS-62.13% / 98.31%

7 Day CHG~0.00%

Published-10 Feb, 2010 | 18:00

Updated-11 Apr, 2025 | 00:51

Heap-based buffer overflow in Microsoft Office PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint document, aka "PowerPoint LinkedSlideAtom Heap Overflow Vulnerability."

Vendor-n/a Microsoft Corporation

Product-powerpoint n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2009-4243

Matching Score-8

Assigner-MITRE Corporation

View Details

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-9.3||HIGH

EPSS-0.85% / 74.57%

7 Day CHG~0.00%

Published-25 Jan, 2010 | 19:00

Updated-11 Apr, 2025 | 00:51

RealNetworks RealPlayer 10, RealPlayer 10.5 6.0.12.1040 through 6.0.12.1741, RealPlayer 11 11.0.0 through 11.0.4, RealPlayer Enterprise, Mac RealPlayer 10 and 10.1, Linux RealPlayer 10, and Helix Player 10.x allow remote attackers to have an unspecified impact via a crafted media file that uses HTTP chunked transfer coding, related to an "overflow."

Vendor-n/a RealNetworks LLC Microsoft Corporation Apple Inc.

Product-realplayer_sp realplayer_enterprise windows realplayer helix_player mac_os_x n/a

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2010-3650

Matching Score-8

Assigner-Adobe Systems Incorporated

View Details

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-9.3||HIGH

EPSS-2.96% / 86.21%

7 Day CHG~0.00%

Published-07 Nov, 2010 | 21:00

Updated-11 Apr, 2025 | 00:51

Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, and CVE-2010-3652.

Vendor-n/a Microsoft Corporation Linux Kernel Organization, Inc Google LLC Sun Microsystems (Oracle Corporation)Apple Inc.Adobe Inc.

Product-linux_kernel windows solaris android flash_player mac_os_x n/a

CVE-2012-0159

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs