CVE-2012-2174: Code Injection
Published Jun 20, 2012
·Updated
The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.
Affected Software
27 affected components
IBM Lotus Notes=8.0
IBM Lotus Notes=8.0.0
IBM Lotus Notes=8.0.1
IBM Lotus Notes=8.0.2
IBM Lotus Notes=8.0.2.0
IBM Lotus Notes=8.0.2.1
IBM Lotus Notes=8.0.2.2
IBM Lotus Notes=8.0.2.3
IBM Lotus Notes=8.0.2.4
IBM Lotus Notes=8.0.2.5
IBM Lotus Notes=8.0.2.6
IBM Lotus Notes=8.5
IBM Lotus Notes=8.5.0.0
IBM Lotus Notes=8.5.0.1
IBM Lotus Notes=8.5.1
IBM Lotus Notes=8.5.1.0
IBM Lotus Notes=8.5.1.1
IBM Lotus Notes=8.5.1.2
IBM Lotus Notes=8.5.1.3
IBM Lotus Notes=8.5.1.4
IBM Lotus Notes=8.5.1.5
IBM Lotus Notes=8.5.2.0
IBM Lotus Notes=8.5.2.1
IBM Lotus Notes=8.5.2.2
IBM Lotus Notes=8.5.2.3
IBM Lotus Notes=8.5.3
IBM Lotus Notes=8.5.3.1
Event History
Jun 20, 2012
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-2174?
CVE-2012-2174 is rated as critical due to its potential for arbitrary code execution.
2
How do I fix CVE-2012-2174?
To fix CVE-2012-2174, upgrade IBM Lotus Notes to version 8.5.3 FP2 or later.
3
What versions of IBM Lotus Notes are affected by CVE-2012-2174?
IBM Lotus Notes versions 8.0 through 8.5.3 are affected by CVE-2012-2174.
4
What type of vulnerability is CVE-2012-2174?
CVE-2012-2174 is a remote code execution vulnerability.
5
Can CVE-2012-2174 be exploited remotely?
Yes, CVE-2012-2174 can be exploited remotely through a crafted notes:// URL.