CVSS: 9.3EPSS: 95%CPEs: 6EXPL: 0CVE-2012-0183 – Microsoft Office 2007 RTF Mismatch Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2012-0183
Microsoft Word 2003 SP3 and 2007 SP2 and SP3, Office 2008 and 2011 for Mac, and Office Compatibility Pack SP2 and SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "RTF Mismatch Vulnerability." Microsoft Word 2003 SP3 y 2007 SP2 y SP3, Office 2008 y 2011 para Mac, y Office Compatibility Pack SP2 y SP3 permite a atacantes remotos ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria) mediante datos RTF manipulados, también conocido como "Vulnerabilidad RTF" This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of RTF files. The code responsible for lexing control words from the input file does not properly validate that all objects are properly defined. By removing terminating values within an RTF file an attacker can cause the program to re-use a freed object. • http://secunia.com/advisories/49111 http://www.securityfocus.com/bid/53344 http://www.securitytracker.com/id?1027035 http://www.us-cert.gov/cas/techalerts/TA12-129A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-029 https://exchange.xforce.ibmcloud.com/vulnerabilities/75122 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15327 •
CVSS: 9.3EPSS: 90%CPEs: 12EXPL: 0CVE-2010-3214
https://notcve.org/view.php?id=CVE-2010-3214
Stack-based buffer overflow in Microsoft Word 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2; Word Viewer; Office Web Apps; and Word Web App allows remote attackers to execute arbitrary code via a crafted Word document, aka "Word Stack Overflow Vulnerability." Desbordamiento de búfer basado en pila en Microsoft Word 2002 SP3, 2003 SP3, 2007 SP2, y 2010; Office 2004 y 2008 para Mac; Open XML File Format Converter para Mac; Office Compatibility Pack for Word, Excel, y PowerPoint 2007 File Formats SP2; Word Viewer; Office Web Apps; y Word Web App permite a atacantes remotos ejecutar código de su elección a través de documentos Word manipulado, también conocido como "Word Stack Overflow Vulnerability". • http://www.securityfocus.com/archive/1/514302/100/0/threaded http://www.us-cert.gov/cas/techalerts/TA10-285A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-079 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7322 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 78%CPEs: 4EXPL: 0CVE-2010-3221
https://notcve.org/view.php?id=CVE-2010-3221
Microsoft Word 2002 SP3 and 2003 SP3, Office 2004 for Mac, and Word Viewer do not properly handle a malformed record during parsing of a Word document, which allows remote attackers to execute arbitrary code via a crafted document that triggers memory corruption, aka "Word Parsing Vulnerability." Microsoft Word 2002 SP3 y 2003 SP3, Office 2004 para Mac, y Word Viewer no maneja adecuadamente un registro mal formado durante el análisis de un documento Word, lo que permite a atacantes remotos ejecutar código de su elección a través de un documento manipulado que provocará una corrupción de memoria, también conocido como "Vulnerabilidad Word Parsing". • http://www.us-cert.gov/cas/techalerts/TA10-285A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-079 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7032 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2010-3200
https://notcve.org/view.php?id=CVE-2010-3200
MSO.dll in Microsoft Word 2003 SP3 11.8326.11.8324 allows remote attackers to cause a denial of service (NULL pointer dereference and multiple-instance application crash) via a crafted buffer in a Word document, as demonstrated by word_crash_11.8326.8324_poc.doc. MSO.dll en Microsoft Word 2003 SP3 v11.8326.11.8324 permite a atacantes remotos provocar una denegación de servicio (desreferenciación a punterio nulo y caída de aplicación por múltiples instancias). • http://www.securityfocus.com/archive/1/513679/100/0/threaded •
CVSS: 9.3EPSS: 90%CPEs: 8EXPL: 0CVE-2010-1901
https://notcve.org/view.php?id=CVE-2010-1901
Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP2; Microsoft Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Word Viewer; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 do not properly handle unspecified properties in rich text data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted RTF document, aka "Word RTF Parsing Engine Memory Corruption Vulnerability." Microsoft Office Word 2002 SP3, 2003 SP3, y 2007 SP2; Microsoft Office 2004 y 2008 para Mac; Open XML File Format Converter para Mac; Office Word Viewer; y Office Compatibility Pack para Word, Excel, y PowerPoint 2007 File Formats SP2, no manejan adecuadamente propiedades sin especificar datos de texto enriquecido, lo que permite a atacantes remotos ejecutar código de su elección o provocar una denegación de servicio (corrupción de memoria) a través de un documento RTF manipulado. También conocido como "Word RTF Parsing Engine Memory Corruption Vulnerability." • http://www.us-cert.gov/cas/techalerts/TA10-222A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-056 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11612 • CWE-94: Improper Control of Generation of Code ('Code Injection') •