CVE-2011-3494

high · 10

WinSig.exe in eSignal 10.6.2425 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) a long StyleTemplate element in a QUO, SUM or POR file, which triggers a stack-based buffer overflow, or (2) a long Font->FaceName field (aka FaceName element), which triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information.

CVSS

55.8%

EPSS (exploit prob.)

99th

EPSS percentile

2011-09-16

Published

AV:N/AC:L/Au:N/C:C/I:C/A:C

Weaknesses

CWE-119

Affected products

Vendor	Product	Affected versions
interactivedata	esignal	<= 10.6.2425
interactivedata	esignal	10.6

Check a specific version with /api/v1/cve/match.

References

http://aluigi.altervista.org/adv/esignal_1-adv.txt
http://secunia.com/advisories/45966
http://aluigi.altervista.org/adv/esignal_1-adv.txt
http://secunia.com/advisories/45966

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2011-3494