CVSS: 9.3EPSS: 90%CPEs: 8EXPL: 0CVE-2010-1901
https://notcve.org/view.php?id=CVE-2010-1901
Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP2; Microsoft Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Word Viewer; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 do not properly handle unspecified properties in rich text data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted RTF document, aka "Word RTF Parsing Engine Memory Corruption Vulnerability." Microsoft Office Word 2002 SP3, 2003 SP3, y 2007 SP2; Microsoft Office 2004 y 2008 para Mac; Open XML File Format Converter para Mac; Office Word Viewer; y Office Compatibility Pack para Word, Excel, y PowerPoint 2007 File Formats SP2, no manejan adecuadamente propiedades sin especificar datos de texto enriquecido, lo que permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (corrupción de memoria) a través de un documento RTF manipulado. También conocido como "Word RTF Parsing Engine Memory Corruption Vulnerability." • http://www.us-cert.gov/cas/techalerts/TA10-222A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-056 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11612 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 76%CPEs: 8EXPL: 0CVE-2010-1902
https://notcve.org/view.php?id=CVE-2010-1902
Buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP2; Microsoft Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Word Viewer; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code via unspecified properties in the data in a crafted RTF document, aka "Word RTF Parsing Buffer Overflow Vulnerability." Desbordamiento de búfer en Microsoft Office Word 2002 SP3, 2003 SP3, y 2007 SP2; Microsoft Office 2004 y 2008 para Mac; Open XML File Format Converter para Mac; Office Word Viewer; y Office Compatibility Pack para Word, Excel, y PowerPoint 2007 File Formats SP2 permite a atacantes remotos ejecutar código de su elección a través de propiedades sin especificar en los datos de un documento RTF manipulado, tambien conocido como "Vulnerabilidad Word RTF Parsing Buffer Overflow" • http://www.us-cert.gov/cas/techalerts/TA10-222A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-056 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11472 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 10.0EPSS: 72%CPEs: 9EXPL: 1CVE-2010-1900 – Microsoft Office Word sprmCMajority Record Parsing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-1900
Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP2; Microsoft Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Word Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; and Works 9 do not properly handle malformed records in a Word file, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, aka "Word Record Parsing Vulnerability." Microsoft Office Word 2002 SP3, 2003 SP3, y 2007 SP2; Microsoft Office 2004 y 2008 para Mac; Open XML File Format Converter para Mac; Office Word Viewer; Office Compatibility Pack para Word, Excel, y PowerPoint 2007 File Formats SP2; y Works 9 no manejan adecuadamente los registros mal formados, lo que permite a atacantes remotos ejecutar código de su elección o causar una denegación de servicio (corrupción de memoria) a través de archivos manipulados, también conocido como "Word Record parsing Vulnerability." This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office Word. User interaction is required to exploit this vulnerability in that the target must open a malicious document. The specific flaw exists in the parsing of sprmCMajority records in a Word document. Due to the lack of parameter checking when processing sprmCMajority sprm groups it is possible to arbitrarily control the amount of data being written to a stack based buffer resulting in a stack overflow vulnerability which can overwrite critical exception structures. • https://www.exploit-db.com/exploits/14971 http://www.us-cert.gov/cas/techalerts/TA10-222A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-056 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11490 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 88%CPEs: 3EXPL: 0CVE-2010-1903 – Microsoft Office Word 2007 plcffldMom Parsing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-1903
Microsoft Office Word 2002 SP3 and 2003 SP3, and Office Word Viewer, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a malformed record in a Word file, aka "Word HTML Linked Objects Memory Corruption Vulnerability." Microsoft Office Word 2002 SP3 y 2003 SP3, y Office Word Viewer, permite a atacantes remotos ejecutar código a su elección o causar una denegación de servicio (corrupción de memoria) a través de un registro mal formado en un fichero Word, también conocido como "Vulnerabilidad Word HTML Linked Objects Memory Corruption." This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Word. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the code responsible for parsing the plcffldMom structure within .doc files. By crafting malicious values within this structure an attacker can force the program to make faulty heap memory allocations. • http://www.us-cert.gov/cas/techalerts/TA10-222A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-056 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12039 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 62%CPEs: 12EXPL: 0CVE-2009-3132
https://notcve.org/view.php?id=CVE-2009-3132
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a spreadsheet containing a malformed formula, related to a "pointer corruption" issue, aka "Excel Index Parsing Vulnerability." Microsoft Office Excel v2002 SP3, v2003 SP3, y v2007 SP1 y SP2; Office v2004 y v2008 para Mac; Open XML File Format Converter para Mac; Office Excel Viewer v2003 SP3; Office Excel Viewer SP1 y SP2; y Office Compatibility Pack para Word, Excel, y PowerPoint v2007 File Formats SP1 y SP2 permite a atacantes remotos ejecutar código de su elección a através de una hoja de cálculo que contiene una formula manipulado, relacionado con el tema "corrupción de puntero", como "vulnerabilidad de análisis de índices de Excel". • http://www.securitytracker.com/id?1023157 http://www.us-cert.gov/cas/techalerts/TA09-314A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6526 • CWE-94: Improper Control of Generation of Code ('Code Injection') •