CVE-2011-0092: Code Injection
The LZW stream decompression functionality in ORMELEMS.DLL in Microsoft Visio 2002 SP2, 2003 SP3, and 2007 SP2 allows remote attackers to execute arbitrary code via a Visio file with a malformed VisioDocument stream that triggers an exception handler that accesses an object that has not been fully initialized, which triggers memory corruption, aka "Visio Object Memory Corruption Vulnerability."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0092?
CVE-2011-0092 is classified as critical due to its potential to allow remote code execution.
How do I fix CVE-2011-0092?
To mitigate CVE-2011-0092, users should update Microsoft Visio to the latest security patches provided by Microsoft.
What software versions are affected by CVE-2011-0092?
CVE-2011-0092 affects Microsoft Visio 2002 SP2, 2003 SP3, and 2007 SP2.
Can CVE-2011-0092 exploit be triggered by opening a file?
Yes, CVE-2011-0092 can be exploited by opening a specially crafted Visio file.
Is user interaction required to exploit CVE-2011-0092?
Yes, an attacker needs the victim to open a malicious Visio file to exploit CVE-2011-0092.