CVE-2016-3235

Katalog CVE

CVSS 7.8 · High KEV · sudah dieksploitasi EPSS 43,3%

Kerentanan pada microsoft visio, microsoft visio viewer. Skor CVSS 3.1 7.8 (High) menurut NVD. Masuk katalog KEV CISA pada 3 November 2021, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."

Rincian

Terbit di NVD

16 Juni 2016

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

43,3% peluang dieksploitasi; lebih tinggi dari 98,7% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Microsoft Office OLE DLL Side Loading Vulnerability

Masuk KEV

3 November 2021

Tenggat CISA

3 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-070 patch · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3235 pemerintah AS
• http://packetstormsecurity.com/files/137490/Microsoft-Visio-DLL-Hijacking.html advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2016/Jun/32 broken link · mailing list · advisory pihak ketiga
• http://www.securityfocus.com/archive/1/538685/100/0/threaded broken link · advisory pihak ketiga · vdb entry
• http://www.securitytracker.com/id/1036093 broken link · advisory pihak ketiga · vdb entry
• https://www.securify.nl/advisory/SFY20150804/microsoft_visio_multiple_dll_side_loading_vulnerabilities.html exploit · advisory pihak ketiga