CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
EPSS
Percentile
99.9%
Microsoft Windows contains a stack-based buffer overflow vulnerability in the graphics rendering engine, which may allow an attacker to execute arbitrary code.
Microsoft Windows contains a stack-based buffer overflow vulnerability caused by a signedness error in the βCreateSizedDIBSECTION()
β function within the shimgvw.dll
library when parsing thumbnail bitmaps containing a negative βbiClrUsed
β value.
Exploit code for this vulnerability is publicly available.
By convincing a user to view a specially crafted file containing a malicious thumbnail bitmap value, an attacker may be able to execute arbitrary code with the privileges of the user.
Apply an update
This issue is addressed in Microsoft Security Bulletin MS11-006.
Modify the Access Control List (ACL) on shimgvw.dll
Microsoft has published information on modifying the Access Control List (ACL) on shimgvw.dll
as a mitigation for this vulnerability.
Windows 7 and Windows Server 2008 R2 are not affected by this vulnerability
106516
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Updated: February 08, 2011
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Group | Score | Vector |
---|---|---|
Base | ||
Temporal | ||
Environmental |
This document was written by Michael Orlando.
CVE IDs: | CVE-2010-3970 |
---|---|
Severity Metric: | 57.32 Date Public: |