CVE-2012-0136: Code Injection

Published Feb 14, 2012

Updated

Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability than CVE-2012-0019, CVE-2012-0020, CVE-2012-0137, and CVE-2012-0138.

Affected Software

2 affected components

Microsoft Visio Viewer=2010

Microsoft Visio Viewer=2010-sp1

Event History

Feb 14, 2012

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0136?

CVE-2012-0136 has a critical severity level due to its potential to allow remote code execution.

How do I fix CVE-2012-0136?

To fix CVE-2012-0136, users should update to the latest security patch provided by Microsoft for Visio Viewer 2010.

Who is affected by CVE-2012-0136?

CVE-2012-0136 affects users of Microsoft Visio Viewer 2010 and its Service Pack 1.

What type of attacks can exploit CVE-2012-0136?

CVE-2012-0136 can be exploited via crafted Visio files that corrupt memory and allow arbitrary code execution.

Is CVE-2012-0136 a direct vulnerability in Microsoft Visio?

No, CVE-2012-0136 specifically affects the Visio Viewer component, not the full Microsoft Visio application.