Unscored severity · published Jan 23, 2012
CVE-2012-0192
Multiple integer overflows in vclmi.dll in the visual class library module in IBM Lotus Symphony before 3.0.1 might allow remote attackers to execute arbitrary code via an…
–
CVSS
5.1%
EPSS
No
On KEV
Description
Multiple integer overflows in vclmi.dll in the visual class library module in IBM Lotus Symphony before 3.0.1 might allow remote attackers to execute arbitrary code via an embedded (1) JPEG or (2) PNG image object in a Symphony document that triggers a heap-based buffer overflow, as demonstrated by a .doc file.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.1% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LS
Lotus Symphony · Ibm
through 3.0.0.3; 1.3; 3.0.0.1; 3.0.0.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-0192
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-0192
osvdb.org
http://osvdb.org/78345
Vendor Advisory
http://secunia.com/advisories/47245
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21578684
www.securityfocus.com
http://www.securityfocus.com/bid/51591
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/72424
More from Lotus Symphony
–
CVE-2010-5204
Multiple untrusted search path vulnerabilities in IBM Lotus Symphony 1.3.0 20090908.0900 allow local users to gain privileges via a Trojan horse (1) eclipse_1114.dll or (2)…
–
CVE-2011-2893
The DataPilot feature in IBM Lotus Symphony 3 before FP3 allows user-assisted remote attackers to cause a denial of service (application crash) via a large .xls spreadsheet with…
–
CVE-2011-2888
IBM Lotus Symphony 3 before FP3 allows remote attackers to cause a denial of service (application hang) via complex graphics in a presentation
–
CVE-2011-2887
IBM Lotus Symphony 3 before FP3 on Linux allows remote attackers to cause a denial of service (application crash) via a certain sample document
–
CVE-2011-2886
IBM Lotus Symphony 3 before FP3 allows remote attackers to cause a denial of service (application crash) via a .docx document with empty bullet styles for parent bullets