PT-2011-3553 · Microsoft · Windows Vista+6

Ivan Sanchez · Published 2011-11-08 · Updated 2025-06-04 · CVE-2011-2016

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 Microsoft Windows Server 2008 R2 Microsoft Windows Server 2008 R2 SP1 Microsoft Windows 7 Gold Microsoft Windows 7 SP1

Description A vulnerability exists in the way Windows Mail and Windows Meeting Space handle the loading of DLL files, allowing for remote code execution. This could enable an attacker to gain complete control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights. The issue can be exploited by a local user via a Trojan horse DLL in the current working directory, for example, a directory containing a .eml or .wcinv file.

Recommendations For Microsoft Windows Vista SP2, update to a newer version to mitigate the risk. For Microsoft Windows Server 2008 SP2, update to a newer version to mitigate the risk. For Microsoft Windows Server 2008 R2, update to a newer version to mitigate the risk. For Microsoft Windows Server 2008 R2 SP1, update to a newer version to mitigate the risk. For Microsoft Windows 7 Gold, update to a newer version to mitigate the risk. For Microsoft Windows 7 SP1, update to a newer version to mitigate the risk.

Fix

Related Identifiers

CVE-2011-2016

Affected Products

Windows

Windows 7

Windows Mail

Windows Meeting Space

Windows Server 2008

Windows Server 2008 R2

Windows Vista

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2011-2016 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-085 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2016 · Security Note
• https://t.me/cvenotify/124613 · Telegram Post
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14028 · Note
• http://technet.microsoft.com/en-us/security/bulletin/MS11-085 · Note