CVE-2014-3802: Input Validation
msdia.dll in Microsoft Debug Interface Access (DIA) SDK, as distributed in Microsoft Visual Studio before 2013, does not properly validate an unspecified variable before use in calculating a dynamic-call address, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDB file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3802?
CVE-2014-3802 has a critical severity level as it allows remote attackers to execute arbitrary code.
How do I fix CVE-2014-3802?
To mitigate CVE-2014-3802, users should upgrade to a version of Microsoft Visual Studio released after 2012, which includes the appropriate security patches.
Which versions of software are affected by CVE-2014-3802?
CVE-2014-3802 affects Microsoft Visual Studio versions 2002, 2003, 2005, and 2010, as well as the Microsoft Debug Interface Access Software Development Kit.
What types of attacks can be executed due to CVE-2014-3802?
CVE-2014-3802 allows attackers to execute arbitrary code or cause a denial of service attack.
Is there a workaround for CVE-2014-3802?
There are no documented workarounds for CVE-2014-3802, and updating the software is the most effective solution.