CVE-2011-4874 : Use-after-free vulnerability in MICROSYS PROMOTIC before 8.1.7 allows user-assis

Use-after-free vulnerability in MICROSYS PROMOTIC before 8.1.7 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (data corruption and application crash) via a crafted project (aka .pra) file.

Published 2012-04-13 10:41:50

Updated 2025-04-11 00:51:22

Source CERT/CC

View at NVD, CVE.org

Vulnerability category: Memory CorruptionExecute codeDenial of service

Products affected by CVE-2011-4874

Microsys » Promotic
Versions up to, including, (<=) 8.1.6
cpe:2.3:a:microsys:promotic:*:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.0.13
cpe:2.3:a:microsys:promotic:8.0.13:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.0.12
cpe:2.3:a:microsys:promotic:8.0.12:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.0.11
cpe:2.3:a:microsys:promotic:8.0.11:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.0.10
cpe:2.3:a:microsys:promotic:8.0.10:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.1.2
cpe:2.3:a:microsys:promotic:8.1.2:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.0.5
cpe:2.3:a:microsys:promotic:8.0.5:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.0.3
cpe:2.3:a:microsys:promotic:8.0.3:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.0.0
cpe:2.3:a:microsys:promotic:8.0.0:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.1.0
cpe:2.3:a:microsys:promotic:8.1.0:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.0.9
cpe:2.3:a:microsys:promotic:8.0.9:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.0.8
cpe:2.3:a:microsys:promotic:8.0.8:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.0.7
cpe:2.3:a:microsys:promotic:8.0.7:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.1.3
cpe:2.3:a:microsys:promotic:8.1.3:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.1.1
cpe:2.3:a:microsys:promotic:8.1.1:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.0.6
cpe:2.3:a:microsys:promotic:8.0.6:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.0.4
cpe:2.3:a:microsys:promotic:8.0.4:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.0.2
cpe:2.3:a:microsys:promotic:8.0.2:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.0.1
cpe:2.3:a:microsys:promotic:8.0.1:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.1.5
cpe:2.3:a:microsys:promotic:8.1.5:*:*:*:*:*:*:*
Matching versions
Microsys » Promotic » Version: 8.1.4
cpe:2.3:a:microsys:promotic:8.1.4:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2011-4874

EPSS FAQ

0.29%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 50 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2011-4874

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.9	HIGH	AV:A/AC:M/Au:N/C:C/I:C/A:C	5.5	10.0	NIST
Access Vector: Adjacent Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2011-4874

CWE-399

Assigned by: nvd@nist.gov (Primary)

References for CVE-2011-4874

http://www.promotic.eu/en/pmdoc/News.htm#ver80107

PROMOTIC system news
http://www.securityfocus.com/bid/52988

PROMOTIC Use After Free Remote Code Execution Vulnerability
https://exchange.xforce.ibmcloud.com/vulnerabilities/74846

PROMOTIC project file code execution CVE-2011-4874 Vulnerability Report
http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-03.pdf

404 - File Not Found | CISA
US Government Resource

Jump to

Vulnerability Details : CVE-2011-4874

Products affected by CVE-2011-4874

Exploit prediction scoring system (EPSS) score for CVE-2011-4874

CVSS scores for CVE-2011-4874

CWE ids for CVE-2011-4874

References for CVE-2011-4874