ID CVE-2012-2528
Summary Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; Word Automation Services on Microsoft SharePoint Server 2010; and Office Web Apps 2010 SP1 allows remote attackers to execute arbitrary code via a crafted RTF document, aka "RTF File listid Use-After-Free Vulnerability."
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:word_automation_services:-:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word_automation_services:-:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:sharepoint_server:2010:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:sharepoint_server:2010:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office_compatibility_pack:*:sp2:*:*:*:*:*:*
    cpe:2.3:a:microsoft:office_compatibility_pack:*:sp2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*
    cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office_web_apps:2010:sp1:*:*:*:*:*:*
    cpe:2.3:a:microsoft:office_web_apps:2010:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:2003:sp3:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:2003:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:2007:sp2:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:2007:sp2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word:2010:sp1:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word:2010:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:word_viewer:*:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:word_viewer:*:*:*:*:*:*:*:*
CVSS
Base: 9.3 (as of 12-10-2018 - 22:03)
Impact:
Exploitability:
CWE CWE-399
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:C/A:C
oval via4
accepted 2014-06-30T04:05:56.636-04:00
class vulnerability
contributors
  • name SecPod Team
    organization SecPod Technologies
  • name Sergey Artykhov
    organization ALTX-SOFT
  • name Maria Kedovskaya
    organization ALTX-SOFT
  • name Dragos Prisaca
    organization G2, Inc.
  • name Maria Kedovskaya
    organization ALTX-SOFT
  • name Maria Kedovskaya
    organization ALTX-SOFT
  • name Maria Kedovskaya
    organization ALTX-SOFT
  • name Maria Mikhno
    organization ALTX-SOFT
definition_extensions
  • comment Microsoft Word 2003 is installed
    oval oval:org.mitre.oval:def:475
  • comment Microsoft Word 2007 SP2 is installed
    oval oval:org.mitre.oval:def:15826
  • comment Microsoft Word 2007 SP3 is installed
    oval oval:org.mitre.oval:def:15946
  • comment Microsoft Office Compatibility Pack SP2 is installed
    oval oval:org.mitre.oval:def:15640
  • comment Microsoft Office Compatibility Pack SP3 is installed
    oval oval:org.mitre.oval:def:15035
  • comment Microsoft SharePoint Server 2010 Service Pack 1 is installed
    oval oval:org.mitre.oval:def:15614
  • comment Microsoft Office Web Apps 2010 Service Pack 1 is installed
    oval oval:org.mitre.oval:def:15860
  • comment Microsoft Word 2010 SP1 is installed
    oval oval:org.mitre.oval:def:14953
  • comment Microsoft Word 2003 SP3 is installed
    oval oval:org.mitre.oval:def:15863
description Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; Word Automation Services on Microsoft SharePoint Server 2010; and Office Web Apps 2010 SP1 allows remote attackers to execute arbitrary code via a crafted RTF document, aka "RTF File listid Use-After-Free Vulnerability."
family windows
id oval:org.mitre.oval:def:15680
status accepted
submitted 2012-10-17T10:23:14
title RTF File listid Use-After-Free Vulnerability - MS12-064
version 37
refmap via4
bid 55781
cert TA12-283A
ms MS12-064
Last major update 12-10-2018 - 22:03
Published 09-10-2012 - 21:55
Back to Top