CVSS: 9.3EPSS: 63%CPEs: 17EXPL: 1CVE-2014-1761 – Microsoft Word Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2014-1761
Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, as exploited in the wild in March 2014. Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 y SP2, 2013 y 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office para Mac 2011; Word Automation Services en SharePoint Server 2010 SP1 y SP2 y 2013; Office Web Apps 2010 SP1 y SP2 y Office Web Apps Server 2013 permiten a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de datos RTF manipulados, tal y como fue explotado en marzo 2014. Microsoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution. • https://www.exploit-db.com/exploits/32793 http://technet.microsoft.com/security/advisory/2953095 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-017 http://blogs.mcafee.com/mcafee-labs/close-look-rtf-zero-day-attack-cve-2014-1761-shows-sophistication-attackers https://www.virustotal.com/en/file/e378eef9f4ea1511aa5e368cb0e52a8a68995000b8b1e6207717d9ed09e8555a/analysis • CWE-787: Out-of-bounds Write •
CVSS: 9.3EPSS: 44%CPEs: 13EXPL: 0CVE-2014-0260
https://notcve.org/view.php?id=CVE-2014-0260
Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 SP1 and SP2 and 2013; Office Web Apps 2010 SP1 and SP2; and Office Web Apps Server 2013 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability." Microsoft Word 2003 Service Pack 3, 2007 SP3, 2010 SP1 y SP2, 2013, y 2013 RT; cOffice Compatibility Pack SP3; Word Viewer; SharePoint Server 2010 SP1 y SP2 y 2013; Office Web Apps 2010 SP1 y SP2, y Office Web Apps Server 2013 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) a través de un documento de Office manipulado, también conocido como "Vulnerabilidad de corrupcion de memoria Word" • http://www.securitytracker.com/id/1029598 http://www.securitytracker.com/id/1029599 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-001 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 44%CPEs: 4EXPL: 0CVE-2014-0258
https://notcve.org/view.php?id=CVE-2014-0258
Microsoft Word 2003 SP3 and 2007 SP3, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability." Microsoft Word 2003 SP3 y 2007 SP3, Office Compatibility Pack SP3 y Word Viewer permite a atacantes remotos ejecutar código d eforma arbitraria o causar una denegación de servicio (corrupción de memoria) a través de un documento Office manipulado, tambien conocido como "Word Memory Corruption Vulnerability." • http://www.securitytracker.com/id/1029598 http://www.securitytracker.com/id/1029599 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-001 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 44%CPEs: 2EXPL: 0CVE-2014-0259
https://notcve.org/view.php?id=CVE-2014-0259
Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability." Microsoft Word 2007 SP3 y Office Compatibility Pack SP3 permite a atacantes remotos ejecutar código de forma arbitraria o causar una denegación de servicio (corrupción de memoria) a través de un documento Office manipulado, tambien conocido como "Word Memory Corruption Vulnerability." • http://www.securitytracker.com/id/1029598 http://www.securitytracker.com/id/1029599 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-001 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 96%CPEs: 13EXPL: 4CVE-2013-3906 – Microsoft Graphics Component Memory Corruption Vulnerability
https://notcve.org/view.php?id=CVE-2013-3906
GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013. El componente GDI + de Microsoft Windows Vista SP2 y Server 2008 SP2, Office 2003 SP3, 2007 SP3 y 2010 SP1 y SP2, Office Compatibility Pack SP3 y Lync 2010, 2010 Attende, 2.013 y Basic 2013 permite a atacantes remotos ejecutar código arbitrario a través de una imagen TIFF manipulada, como se ha demuestrado por exploits relaizados en octubre y noviembre de 2013 al abrir una imagen en un documento Word. Microsoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution. • https://www.exploit-db.com/exploits/30011 http://blogs.mcafee.com/mcafee-labs/mcafee-labs-detects-zero-day-exploit-targeting-microsoft-office-2 http://blogs.technet.com/b/srd/archive/2013/11/05/cve-2013-3906-a-graphics-vulnerability-exploited-through-word-documents.aspx http://technet.microsoft.com/security/advisory/2896666 http://www.exploit-db.com/exploits/30011 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-096 • CWE-94: Improper Control of Generation of Code ('Code Injection') •