CVSS: 9.3EPSS: 89%CPEs: 24EXPL: 0CVE-2015-1682 – Microsoft Word ptCount Element Uninitialized Memory Read Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2015-1682
Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Office 2013 RT SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Office for Mac 2011, Excel for Mac 2011, PowerPoint for Mac 2011, Word for Mac 2011, PowerPoint Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Excel Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, SharePoint Foundation 2010 SP2, and SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." Microsoft Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Word 2010 SP2, Office 2013 SP1, Excel 2013 SP1, PowerPoint 2013 SP1, Word 2013 SP1, Office 2013 RT SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Office for Mac 2011, Excel for Mac 2011, PowerPoint for Mac 2011, Word for Mac 2011, PowerPoint Viewer, Word Automation Services on SharePoint Server 2010 SP2 y 2013 SP1, Excel Services on SharePoint Server 2010 SP2 y 2013 SP1, Office Web Apps 2010 SP2, Excel Web App 2010 SP2, Office Web Apps Server 2013 SP1, SharePoint Foundation 2010 SP2, y SharePoint Server 2013 SP1 permiten a atacantes remotos ejecutar código arbitrario a través de un documento manipulado, también conocido como 'vulnerabilidad de la corrupción de memoria de Microsoft Office.' This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Word. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of embedded charts. By providing a malformed .docx file with an invalid "ptCount" node, an attacker can force uninitialized memory to be read. • http://www.securityfocus.com/bid/74481 http://www.securitytracker.com/id/1032295 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-046 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 95%CPEs: 10EXPL: 0CVE-2011-0655 – Microsoft PowerPoint TimeColorBehaviorContainer Floating Point Record Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0655
Microsoft PowerPoint 2007 SP2 and 2010; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; PowerPoint Viewer; PowerPoint Viewer 2007 SP2; and PowerPoint Web App do not properly validate TimeColorBehaviorContainer Floating Point records in PowerPoint documents, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document containing an invalid record, aka "Floating Point Techno-color Time Bandit RCE Vulnerability." Microsoft PowerPoint 2007 SP2 y 2010; Office 2004, 2008, y 2011 for Mac; Open XML File Format Converter para Mac; Office Compatibility Pack para Word, Excel, y PowerPoint 2007 File Formats SP2; PowerPoint Viewer; PowerPoint Viewer 2007 SP2; y PowerPoint Web App no valida adecuadamente los registros imeColorBehaviorContainer Floating Point en documentos PowerPoint, lo que permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (corrupción de memoria) a través de un documento manipulado que contiene un registro incorrecto. También conocida como "Floating Point Techno-color Time Bandit RCE Vulnerability." This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office PowerPoint. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within how the application parses a record associated with animation. • http://www.securitytracker.com/id?1025340 http://www.us-cert.gov/cas/techalerts/TA11-102A.html http://www.vupen.com/english/advisories/2011/0941 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-022 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12624 • CWE-20: Improper Input Validation •
CVSS: 9.3EPSS: 85%CPEs: 12EXPL: 0CVE-2011-0656 – Microsoft Office PowerPoint PersistDirectoryEntry Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0656
Microsoft PowerPoint 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004, 2008, and 2011 for Mac; Open XML File Format Converter for Mac; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; PowerPoint Viewer; PowerPoint Viewer 2007 SP2; and PowerPoint Web App do not properly validate PersistDirectoryEntry records in PowerPoint documents, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a Slide with a malformed record, which triggers an exception and later use of an unspecified method, aka "Persist Directory RCE Vulnerability." PowerPoint 2002 SP3, 2003 SP3, 2007 SP2, y 2010; Office 2004, 2008, y 2011 para Mac; Open XML File Format Converter para Mac; Office Compatibility Pack para Word, Excel, y PowerPoint 2007 File Formats SP2; PowerPoint Viewer; PowerPoint Viewer 2007 SP2; y PowerPoint Web App, de Microsoft, no comprueba apropiadamente los registros de PersistDirectoryEntry en documentos de PowerPoint, lo que permite a los atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) por medio de una Diapositiva con un registro malformado, lo que desencadena una excepción y luego el uso de un método no especificado, también se conoce como "Persist Directory RCE Vulnerability." This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office PowerPoint. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within how the application handles an exception within the PersistDirectoryEntry records when loading a presentation. When an entry points to a container containing a Slide with a malformed record, the application will raise an exception during the loading of the record. • http://osvdb.org/71770 http://www.securityfocus.com/archive/1/517482/100/0/threaded http://www.securityfocus.com/bid/47251 http://www.securitytracker.com/id?1025340 http://www.us-cert.gov/cas/techalerts/TA11-102A.html http://www.vupen.com/english/advisories/2011/0941 http://www.zerodayinitiative.com/advisories/ZDI-11-125 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-022 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval • CWE-20: Improper Input Validation •