CVE-2011-0912: Input Validation
Published Feb 8, 2011
·Updated
Argument injection vulnerability in IBM Lotus Notes 8.0.x before 8.0.2 FP6 and 8.5.x before 8.5.1 FP5 allows remote attackers to execute arbitrary code via a cai:// URL containing a --launcher.library option that specifies a UNC share pathname for a DLL file, aka SPR PRAD82YJW2.
Affected Software
16 affected components
IBM Lotus Notes=8.0.2.0
IBM Lotus Notes=8.0.2.5
IBM Lotus Notes=8.0.2.1
IBM Lotus Notes=8.0.1
IBM Lotus Notes=8.0.2.3
IBM Lotus Notes=8.0.2
IBM Lotus Notes=8.0.2.4
IBM Lotus Notes=8.0
IBM Lotus Notes=8.0.2.2
IBM Lotus Notes=8.5.0.1
IBM Lotus Notes=8.5.1.3
IBM Lotus Notes=8.5.1.2
IBM Lotus Notes=8.5.1.4
IBM Lotus Notes=8.5.0.0
IBM Lotus Notes=8.5.1.1
IBM Lotus Notes=8.5.1.0
Event History
Feb 8, 2011
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-0912?
CVE-2011-0912 has a medium severity rating due to its potential to allow remote code execution.
2
How do I fix CVE-2011-0912?
To fix CVE-2011-0912, update IBM Lotus Notes to version 8.0.2 FP6 or 8.5.1 FP5 or later.
3
Which versions of IBM Lotus Notes are affected by CVE-2011-0912?
CVE-2011-0912 affects IBM Lotus Notes versions 8.0.x before 8.0.2 FP6 and 8.5.x before 8.5.1 FP5.
4
Can CVE-2011-0912 allow attackers to execute arbitrary code?
Yes, CVE-2011-0912 allows remote attackers to execute arbitrary code through crafted URL arguments.
5
What type of vulnerability is CVE-2011-0912 categorized as?
CVE-2011-0912 is categorized as an argument injection vulnerability.