CVE-2011-4039

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Invensys Wonderware HMI Reports 3.42.835.0304 and earlier, as used in Ocean Data Systems Dream Report before 4.0 and other products, allows user-assisted remote attackers to execute arbitrary code via a malformed file that triggers a "write access violation."

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/47742Vendor Advisory
http://secunia.com/advisories/47933Vendor Advisory
http://www.us-cert.gov/control_systems/pdf/ICSA-12-024-01.pdfUS Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-12-039-01.pdfUS Government Resource
http://secunia.com/advisories/47742Vendor Advisory
http://secunia.com/advisories/47933Vendor Advisory
http://www.us-cert.gov/control_systems/pdf/ICSA-12-024-01.pdfUS Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-12-039-01.pdfUS Government Resource

Timeline

Published: Feb 10, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-404010.0Buffer overflow in MiniSmtp 3.0.11818 in NJStar Communicator allows remote attackers to execute arbitrary code via a crafted packet.CVE-2011-404110.0webvrpcs.exe in Advantech/BroadWin WebAccess allows remote attackers to execute arbitrary code or obtain a security-code value via a long st CVE-2011-40429.3An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to CVE-2011-40439.3Integer overflow in an unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows CVE-2011-40445.8An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to CVE-2011-40454.3Buffer overflow in an unspecified ActiveX control in aipgctl.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows r CVE-2011-40465.0The Dell KACE K2000 System Deployment Appliance stores the recovery account password in cleartext within a PHP script, which allows context-CVE-2011-40479.3The Dell KACE K2000 System Deployment Appliance allows remote attackers to execute arbitrary commands by leveraging database write access.CVE-2011-40484.3The Dell KACE K2000 System Deployment Appliance has a default username and password for the read-only reporting account, which makes it easi CVE-2011-40505.0Buffer overflow in 7-Technologies (7T) Interactive Graphical SCADA System (IGSS) 9.0.0.11200 allows remote attackers to cause a denial of se CVE-2011-405110.0CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which CVE-2011-40529.3Stack-based buffer overflow in CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 allows r