LiveActive security incident?Get immediate response
CVE Record

CVE-2012-6277: Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in Symantec Mail Securi...

Multiple unspecified vulnerabilities in Autonomy KeyView IDOL before 10.16, as used in Symantec Mail Security for Microsoft Exchange before 6.5.8, Symantec Mail Security for Domino before 8.1.1, Symantec Messaging Gateway before 10.0.1, Symantec Data Loss Prevention (DLP) before 11.6.1, IBM Notes 8.5.x, IBM Lotus Domino 8.5.x before 8.5.3 FP4, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, related to "a number of underlying issues" in which "some of these cases demonstrated memory corruption with attacker-controlled input and could be exploited to run arbitrary code."

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2012-6277 concerns file-parsing flaws in Autonomy KeyView IDOL used inside mail, messaging, DLP, and collaboration products. A malicious file could crash affected systems or potentially run attacker-controlled code. Business urgency is highest where legacy Symantec or IBM Notes/Domino systems still process untrusted attachments or documents.

Executive priority

Treat as high priority for legacy environments because vulnerable parsers can be reached through routine document handling. If affected products are no longer present or fully upgraded, residual urgency drops substantially.

Technical view

The CVE describes multiple unspecified KeyView IDOL vulnerabilities before 10.16 involving memory corruption from attacker-controlled crafted files. Affected integrations include Symantec Mail Security, Messaging Gateway, DLP, IBM Notes, IBM Lotus Domino, and other embedded KeyView consumers. Public details do not name the exact parser formats or primitives.

Likely exposure

Exposure is most plausible in legacy email gateways, Domino/Notes environments, DLP systems, or other products embedding Autonomy KeyView before 10.16, especially where they automatically inspect inbound files.

Exploitation context

The bundle supports remote crafted-file attack potential and possible arbitrary code execution or denial of service. It does not show CISA KEV listing, confirmed active exploitation, public exploit availability, or complete technical exploit details.

Researcher notes

Evidence is broad and partly unspecified. The strongest technical signal is memory corruption in KeyView parsing with attacker-controlled input, but sources do not provide parser-specific root cause, exploit reliability, or full affected-product enumeration.

Mitigation direction

  • Upgrade Autonomy KeyView IDOL to 10.16 or later where directly deployed.
  • Upgrade listed Symantec products to the fixed versions or later supported releases.
  • Apply IBM Notes/Domino fixes identified by IBM guidance.
  • Identify other products embedding KeyView and check vendor advisories.
  • Restrict processing of untrusted file attachments where legacy systems remain.

Validation and detection

  • Inventory Symantec Mail Security, Messaging Gateway, DLP, IBM Notes, and Domino versions.
  • Confirm whether any installed product embeds Autonomy KeyView IDOL before 10.16.
  • Review vendor advisories for exact fixed build levels and prerequisites.
  • Use authenticated vulnerability scanning where available, such as the referenced Tenable plugin.
  • Check mail and DLP processing paths that automatically inspect external files.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2012-6277 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
9Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aAutonomy KeyView IDOLbefore 10.16Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.