CVE-2010-3970

CVSS V2 High 9.3 CVSS V3 None
Description
Stack-based buffer overflow in the CreateSizedDIBSECTION function in shimgvw.dll in the Windows Shell graphics processor (aka graphics rendering engine) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP1 and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted .MIC or unspecified Office document containing a thumbnail bitmap with a negative biClrUsed value, as reported by Moti and Xu Hao, aka "Windows Shell Graphics Processing Overrun Vulnerability."
Overview
  • CVE ID
  • CVE-2010-3970
  • Assigner
  • secure@microsoft.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2010-12-22T21:00:16
  • Last Modified Date
  • 2019-02-26T14:04:00
Weakness Enumerations
CWE URL
CWE-119 http://cwe.mitre.org/data/definitions/119.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:* 1 OR
cpe:2.3:o:microsoft:windows_server_2008:*:*:itanium:*:*:*:*:* 1 OR
cpe:2.3:o:microsoft:windows_server_2008:*:*:x32:*:*:*:*:* 1 OR
cpe:2.3:o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:* 1 OR
cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x32:*:*:*:*:* 1 OR
cpe:2.3:o:microsoft:windows_server_2008:*:sp2:x64:*:*:*:*:* 1 OR
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:* 1 OR
cpe:2.3:o:microsoft:windows_vista:*:sp1:*:*:*:*:*:* 1 OR
cpe:2.3:o:microsoft:windows_vista:*:sp1:x64:*:*:*:*:* 1 OR
cpe:2.3:o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:* 1 OR
cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:* 1 OR
cpe:2.3:o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:C/I:C/A:C
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • COMPLETE
  • Integrity Impact
  • COMPLETE
  • Availability Impact
  • COMPLETE
  • Base Score
  • 9.3
  • Severity
  • HIGH
  • Exploitability Score
  • 8.6
  • Impact Score
  • 10
References
Reference URL Reference Tags
http://www.powerofcommunity.net/speaker.html
http://www.securityfocus.com/bid/45662 Exploit
http://www.metasploit.com/redmine/projects/framework/repository/revisions/11466/entry/modules/exploits/windows/fileformat/ms11_xxx_createsizeddibsection.rb Exploit
http://secunia.com/advisories/42779 Vendor Advisory
http://www.kb.cert.org/vuls/id/106516 US Government Resource
http://www.vupen.com/english/advisories/2011/0018 Vendor Advisory
http://www.microsoft.com/technet/security/advisory/2490606.mspx Vendor Advisory
http://www.securitytracker.com/id?1024932
http://blogs.technet.com/b/srd/archive/2011/01/07/assessing-the-risk-of-public-issues-currently-being-tracked-by-the-msrc.aspx
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11671
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-006
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2010-3970
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3970
History
Created Old Value New Value Data Type Notes
2022-05-10 07:58:06 Added to TrackCVE