Microsoft Windows Remote Code Execution Vulnerability

CAO 8.8ĐANG BỊ KHAI THÁC (CISA KEV)CVE-2011-3402 · Công bố 04/11/2011 · cập nhật 16/06/2026

Microsoft Windows Remote Code Execution Vulnerability. Đang bị khai thác thực tế: CISA đưa lỗ hổng này vào danh mục Known Exploited Vulnerabilities ngày 06/10/2025. Hãy vá các hệ thống bị ảnh hưởng ngay.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
Windows Microsoft	Chưa có thông tin phiên bản (sản phẩm theo CISA KEV)

Mô tả

Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page, as exploited in the wild in November 2011 by Duqu, aka "TrueType Font Parsing Vulnerability."

Tham khảo

blogs.mcafee.com/mcafee-labs/the-day-of-the-golden-jackal-%E2%80%93-further-tales-of-the-stuxnet-files · Broken Link
blogs.technet.com/b/msrc/archive/2011/11/03/microsoft-releases-security-advisory-2639658.aspx · Vendor Advisory
isc.sans.edu/diary/Duqu+Mitigation/11950 · Third Party Advisory
secunia.com/advisories/49121 · Vendor Advisory
secunia.com/advisories/49122 · Vendor Advisory
technet.microsoft.com/security/advisory/2639658 · Vendor Advisory
securelist.com/en/blog/208193197/The_Mystery_of_Duqu_Part_Two · Not Applicable
securitytracker.com/id · Broken Link
symantec.com/connect/w32-duqu_status-updates_installer-zero-day-exploit · Not Applicable
symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf · Not Applicable
us-cert.gov/cas/techalerts/TA11-347A.html · US Government Resource
us-cert.gov/cas/techalerts/TA12-129A.html · US Government Resource
us-cert.gov/cas/techalerts/TA12-164A.html · US Government Resource
us-cert.gov/control_systems/pdf/ICS-ALERT-11-291-01E.pdf · US Government Resource
docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-087 · Vendor Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-034 · Vendor Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-039 · Vendor Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13998 · Broken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15290 · Broken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15645 · Broken Link
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2011-3402

Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.

Quét site miễn phí