{"api_version":"1","generated_at":"2026-07-23T04:35:05+00:00","cve":"CVE-2011-0977","urls":{"html":"https://cve.report/CVE-2011-0977","api":"https://cve.report/api/cve/CVE-2011-0977.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2011-0977","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2011-0977"},"summary":{"title":"CVE-2011-0977","description":"Use-after-free vulnerability in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via malformed shape data in the Office drawing file format, aka \"Microsoft Office Graphic Object Dereferencing Vulnerability.\"","state":"PUBLISHED","assigner":"mitre","published_at":"2011-02-10 19:00:01","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-399","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"9.3","severity":"","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"}}],"references":[{"url":"http://www.us-cert.gov/cas/techalerts/TA11-102A.html","name":"http://www.us-cert.gov/cas/techalerts/TA11-102A.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"US-CERT Technical Cyber Security Alert TA11-102A -- Microsoft Updates for Multiple Vulnerabilities","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-023","name":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-023","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft Security Bulletin MS11-023 - Important | Microsoft Docs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1025343","name":"http://www.securitytracker.com/id?1025343","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft Office DLL Loading and Graphic Object Processing Flaws Let Remote Users Execute Arbitrary Code - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/44015","name":"http://secunia.com/advisories/44015","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft Office Two Vulnerabilities - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12339","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12339","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/43216","name":"http://secunia.com/advisories/43216","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft Office Excel Shape Data Parsing Use-After-Free Vulnerability - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://dvlabs.tippingpoint.com/blog/2011/02/07/zdi-disclosure-microsoft","name":"http://dvlabs.tippingpoint.com/blog/2011/02/07/zdi-disclosure-microsoft","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"TippingPoint | DVLabs | ZDI Public Disclosure: Microsoft","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://zerodayinitiative.com/advisories/ZDI-11-043/","name":"http://zerodayinitiative.com/advisories/ZDI-11-043/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Zero Day Initiative","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2011/0942","name":"http://www.vupen.com/english/advisories/2011/0942","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-0977","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-0977","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2011","cve_id":"977","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"excel","cpe6":"2007","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T22:14:26.457Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"TA11-102A","tags":["third-party-advisory","x_refsource_CERT","x_transferred"],"url":"http://www.us-cert.gov/cas/techalerts/TA11-102A.html"},{"name":"MS11-023","tags":["vendor-advisory","x_refsource_MS","x_transferred"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-023"},{"name":"43216","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/43216"},{"name":"ADV-2011-0942","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2011/0942"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://zerodayinitiative.com/advisories/ZDI-11-043/"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://dvlabs.tippingpoint.com/blog/2011/02/07/zdi-disclosure-microsoft"},{"name":"oval:org.mitre.oval:def:12339","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12339"},{"name":"44015","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/44015"},{"name":"1025343","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1025343"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2011-02-07T00:00:00.000Z","descriptions":[{"lang":"en","value":"Use-after-free vulnerability in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via malformed shape data in the Office drawing file format, aka \"Microsoft Office Graphic Object Dereferencing Vulnerability.\""}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-12T19:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"TA11-102A","tags":["third-party-advisory","x_refsource_CERT"],"url":"http://www.us-cert.gov/cas/techalerts/TA11-102A.html"},{"name":"MS11-023","tags":["vendor-advisory","x_refsource_MS"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-023"},{"name":"43216","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/43216"},{"name":"ADV-2011-0942","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2011/0942"},{"tags":["x_refsource_MISC"],"url":"http://zerodayinitiative.com/advisories/ZDI-11-043/"},{"tags":["x_refsource_MISC"],"url":"http://dvlabs.tippingpoint.com/blog/2011/02/07/zdi-disclosure-microsoft"},{"name":"oval:org.mitre.oval:def:12339","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12339"},{"name":"44015","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/44015"},{"name":"1025343","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1025343"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2011-0977","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Use-after-free vulnerability in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via malformed shape data in the Office drawing file format, aka \"Microsoft Office Graphic Object Dereferencing Vulnerability.\""}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"TA11-102A","refsource":"CERT","url":"http://www.us-cert.gov/cas/techalerts/TA11-102A.html"},{"name":"MS11-023","refsource":"MS","url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-023"},{"name":"43216","refsource":"SECUNIA","url":"http://secunia.com/advisories/43216"},{"name":"ADV-2011-0942","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2011/0942"},{"name":"http://zerodayinitiative.com/advisories/ZDI-11-043/","refsource":"MISC","url":"http://zerodayinitiative.com/advisories/ZDI-11-043/"},{"name":"http://dvlabs.tippingpoint.com/blog/2011/02/07/zdi-disclosure-microsoft","refsource":"MISC","url":"http://dvlabs.tippingpoint.com/blog/2011/02/07/zdi-disclosure-microsoft"},{"name":"oval:org.mitre.oval:def:12339","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12339"},{"name":"44015","refsource":"SECUNIA","url":"http://secunia.com/advisories/44015"},{"name":"1025343","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1025343"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2011-0977","datePublished":"2011-02-10T18:00:00.000Z","dateReserved":"2011-02-10T00:00:00.000Z","dateUpdated":"2024-08-06T22:14:26.457Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2011-02-10 19:00:01","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-399","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:C/I:C/A:C","baseScore":9.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"COMPLETE","integrityImpact":"COMPLETE","availabilityImpact":"COMPLETE"},"baseSeverity":"HIGH","exploitabilityScore":8.6,"impactScore":10,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:excel:2007:*:*:*:*:*:*:*","matchCriteriaId":"5A70D659-F648-4870-852A-4E86D1F4B646"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2011","CveId":"977","Ordinal":"1","Title":"CVE-2011-0977","CVE":"CVE-2011-0977","Year":"2011"},"notes":[{"CveYear":"2011","CveId":"977","Ordinal":"1","NoteData":"Use-after-free vulnerability in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via malformed shape data in the Office drawing file format, aka \"Microsoft Office Graphic Object Dereferencing Vulnerability.\"","Type":"Description","Title":"CVE-2011-0977"},{"CveYear":"2011","CveId":"977","Ordinal":"2","NoteData":"2011-02-10","Type":"Other","Title":"Published"},{"CveYear":"2011","CveId":"977","Ordinal":"3","NoteData":"2018-10-12","Type":"Other","Title":"Modified"}]}}}