CVSS: 9.3EPSS: 84%CPEs: 16EXPL: 0CVE-2006-3650 – Microsoft Word Malformed Chart Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2006-3650
Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac do not properly parse the length of a chart record, which allows remote user-assisted attackers to execute arbitrary code via a Word document with an embedded malformed chart record that triggers an overwrite of pointer values with values from the document, a different vulnerability than CVE-2006-3434, CVE-2006-3864, and CVE-2006-3868. Microsoft Office 2000, XP, 2003, 2004 para Mac, y v.X para Mac no analiza adecuadamente la longitud de un registro de un gráfico, lo cual permite a atacantes remotos con la intervención del usuario ejecutar código de su elección mediante un documento Word con un registro de gráfico mal formado que dispara la sobrescritura de los valores de punteros con valores del documento, una vulnerabilidad diferente que CVE-2006-3434, CVE-2006-3864, y CVE-2006-3868. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Office. Exploitation requires that the attacker coerce the target user into opening a malicious .XLS file. The specific flaw exists during the processing of malformed charts embedded within a Word document. Upon closing the document, certain pointers are corrupted with data direclty from the file. • http://secunia.com/advisories/22339 http://securitytracker.com/id?1017034 http://www.kb.cert.org/vuls/id/534276 http://www.osvdb.org/29428 http://www.securityfocus.com/archive/1/448151/100/0/threaded http://www.securityfocus.com/archive/1/449179/100/0/threaded http://www.securityfocus.com/bid/20383 http://www.vupen.com/english/advisories/2006/3981 http://www.zerodayinitiative.com/advisories/ZDI-06-034.html https://docs.microsoft.com/en-us/security-updates/securitybullet • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 73%CPEs: 14EXPL: 0CVE-2006-3435 – Microsoft PowerPoint Malformed Slide Notes Rebuilding Vulnerability
https://notcve.org/view.php?id=CVE-2006-3435
PowerPoint in Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac does not properly parse the slide notes field in a document, which allows remote user-assisted attackers to execute arbitrary code via crafted data in this field, which triggers an erroneous object pointer calculation that uses data from within the document. NOTE: this issue is different than other PowerPoint vulnerabilities including CVE-2006-4694. PowerPoint en Microsoft Office 2000, XP, 2003, 2004 para Mac, y v.X para Mac no analiza adecuadamente el campo de notas de diapositiva en un documento, lo cual permite a atacantes con la intervención del usuario ejecutar código de su elección mediante datos manipulados en este campo, lo cual dispara un cálculo erróneo de puntero de objeto que utiliza datos de dentro del documento. NOTA: este problema es diferente de otras vulnerabilidades PowerPoint incluyendo CVE-2006-4694. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Office. • http://securitytracker.com/id?1017030 http://www.kb.cert.org/vuls/id/187028 http://www.osvdb.org/29446 http://www.securityfocus.com/archive/1/448149/100/0/threaded http://www.securityfocus.com/archive/1/449179/100/0/threaded http://www.securityfocus.com/bid/20304 http://www.vupen.com/english/advisories/2006/3977 http://www.zerodayinitiative.com/advisories/ZDI-06-032.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-058 https://oval.c • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 58%CPEs: 15EXPL: 3CVE-2006-1540 – Microsoft Office Products - Array Index Bounds Error (PoC)
https://notcve.org/view.php?id=CVE-2006-1540
MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of service and execute arbitrary code via multiple attack vectors, as originally demonstrated using a crafted document record with a malformed string, as demonstrated by replacing a certain "01 00 00 00" byte sequence with an "FF FF FF FF" byte sequence, possibly causing an invalid array index, in (1) an Excel .xls document, which triggers an access violation in ole32.dll; (2) an Excel .xlw document, which triggers an access violation in excel.exe; (3) a Word document, which triggers an access violation in mso.dll in winword.exe; and (4) a PowerPoint document, which triggers an access violation in powerpnt.txt. NOTE: after the initial disclosure, this issue was demonstrated by triggering an integer overflow using an inconsistent size for a Unicode "Sheet Name" string. • https://www.exploit-db.com/exploits/1615 http://secunia.com/advisories/21012 http://securitytracker.com/id?1015855 http://www.kb.cert.org/vuls/id/609868 http://www.osvdb.org/27150 http://www.securityfocus.com/archive/1/439697/100/0/threaded http://www.securityfocus.com/bid/17252 http://www.securityfocus.com/bid/18889 http://www.us-cert.gov/cas/techalerts/TA06-192A.html http://www.vupen.com/english/advisories/2006/2756 https://docs.microsoft.com/en-us/sec • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.1EPSS: 69%CPEs: 11EXPL: 1CVE-2006-0030 – Microsoft Excel 95 < 2004 - Malformed Graphic File Code Execution
https://notcve.org/view.php?id=CVE-2006-0030
Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed graphic, which leads to memory corruption. • https://www.exploit-db.com/exploits/27055 http://secunia.com/advisories/19138 http://secunia.com/advisories/19238 http://securitytracker.com/id?1015766 http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm http://www.kb.cert.org/vuls/id/123222 http://www.osvdb.org/23901 http://www.securityfocus.com/bid/16181 http://www.us-cert.gov/cas/techalerts/TA06-073A.html http://www.vupen.com/english/advisories/2006/0950 https://docs.microsoft.com/en-us/security- •
CVSS: 5.1EPSS: 70%CPEs: 11EXPL: 0CVE-2006-0029
https://notcve.org/view.php?id=CVE-2006-0029
Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed description, which leads to memory corruption. • http://secunia.com/advisories/19138 http://secunia.com/advisories/19238 http://securityreason.com/securityalert/585 http://securityreason.com/securityalert/586 http://securitytracker.com/id?1015766 http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm http://www.kb.cert.org/vuls/id/235774 http://www.osvdb.org/23900 http://www.us-cert.gov/cas/techalerts/TA06-073A.html http://www.vupen.com/english/advisories/2006/0950 https://docs.microsoft.com/en-us/security-upda •