9.3

CVE-2012-1856

Warnung
The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka "MSCOMCTL.OCX RCE Vulnerability."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Commerce Server Version 2002 Update sp4
Microsoft ≫ Commerce Server Version 2007 Update sp2
Microsoft ≫ Commerce Server Version 2009
Microsoft ≫ Commerce Server Version 2009 Update r2
Microsoft ≫ Host Integration Server Version 2004 Update sp1
Microsoft ≫ Office Version 2003 Update sp3
Microsoft ≫ Office Version 2007 Update sp2
Microsoft ≫ Office Version 2007 Update sp3
Microsoft ≫ Office Version 2010 Update sp1 Edition x86
Microsoft ≫ Office Web Components Version 2003 Update sp3
Microsoft ≫ Sql Server Version 2000 Update sp4
Microsoft ≫ Sql Server Version 2000 Update sp4 Edition analysis_services
Microsoft ≫ Sql Server Version 2005 Update sp3 Edition express_advanced_services
Microsoft ≫ Sql Server Version 2005 Update sp4
Microsoft ≫ Sql Server Version 2008 Update r2_sp1
Microsoft ≫ Sql Server Version 2008 Update r2_sp2
Microsoft ≫ Sql Server Version 2008 Update sp2
Microsoft ≫ Sql Server Version 2008 Update sp3
Microsoft ≫ Visual Basic Version 6.0
Microsoft ≫ Visual Foxpro Version 8.0 Update sp1
Microsoft ≫ Visual Foxpro Version 9.0 Update sp2

03.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability

Schwachstelle

The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 61.83% 0.991
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CISA-ADP 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://www.us-cert.gov/cas/techalerts/TA12-227A.html
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/54948
Third Party Advisory
Broken Link
VDB Entry
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-060
Patch
Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15447
Broken Link
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2012-1856
US Government Resource