CVSS: 9.3EPSS: 77%CPEs: 15EXPL: 0CVE-2010-0261
https://notcve.org/view.php?id=CVE-2010-0261
Heap-based buffer overflow in Microsoft Office Excel 2007 SP1 and SP2 and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted spreadsheet in which "a MDXSET record is broken up into several records," aka "Microsoft Office Excel MDXSET Record Heap Overflow Vulnerability." Desbordamiento de búfer basado en memoria dinámica (heap) en Microsoft Office Excel v2007 SP1 y SP2 y Office Compatibility Pack para Word, Excel, y para formatos de ficheros PowerPoint v2007 SP1 y SP2 permite a atacantes remotos ejecutar código de su elección a través de una hoja de cálculo manipulada, también conocida como "Vulnerabilidad de desbordamiento de pila de Microsoft Office Excel MDXSET record" • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=861 http://www.securitytracker.com/id?1023698 http://www.us-cert.gov/cas/techalerts/TA10-068A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-017 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8479 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.3EPSS: 80%CPEs: 15EXPL: 0CVE-2010-0262
https://notcve.org/view.php?id=CVE-2010-0262
Microsoft Office Excel 2007 SP1 and SP2 and Office 2004 for Mac do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that triggers access of an uninitialized stack variable, aka "Microsoft Office Excel FNGROUPNAME Record Uninitialized Memory Vulnerability." Microsoft Office Excel 2007 SP1 y SP2 y Office 2004 para Mac no analiza correctamente el formato de archivo Excel, lo cual permite a atacantes remotos ejecutar código a su elección a través de una hoja de cálculo manipulada, tambien conocido como "Vulnerabilidad de Memoria de Registro FNGROUPNAME No Inicializada de Microsoft Office Excel". • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=860 http://www.securitytracker.com/id?1023698 http://www.us-cert.gov/cas/techalerts/TA10-068A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-017 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8562 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.3EPSS: 18%CPEs: 13EXPL: 0CVE-2010-0258
https://notcve.org/view.php?id=CVE-2010-0258
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that causes memory to be interpreted as a different object type than intended, aka "Microsoft Office Excel Sheet Object Type Confusion Vulnerability." Microsoft Office Excel 2002 SP3, 2003 SP3, y 2007 SP1 y SP2; Office 2004 y 2008 para Mac; Open XML File Format Converter para Mac; Office Excel Viewer SP1 y SP2; y Office Compatibility Pack para Word, Excel, y PowerPoint 2007 File Formats SP1 y SP2 no validan adecuadamente el formato de archivo Excel, lo que permite a atacantes remotos ejecutar código de su elección a través de una hoja de cálculo. También conocida como "Vulnerabilidad Microsoft Office Excel Sheet Object Type Confusion". • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=859 http://www.securitytracker.com/id?1023698 http://www.us-cert.gov/cas/techalerts/TA10-068A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-017 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8545 • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 9.3EPSS: 64%CPEs: 15EXPL: 0CVE-2010-0264
https://notcve.org/view.php?id=CVE-2010-0264
Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Microsoft Office Excel DbOrParamQry Record Parsing Vulnerability." Microsoft Office Excel 2002 SP3, Office 2004 y 2008 para Mac y el Conversor de Formatos de Ficheros Open XML -Open XML File Format Converter- para Mac, no analizan adecuadamente los formatos de fichero Excel, esto permite a atacantes remotos ejecutar código de su elección a través de una hoja manipulada. También se conoce como "Vulnerabilidad de análisis de documento en Microsoft Office Excel DbOrParamQry" • http://www.securitytracker.com/id?1023698 http://www.us-cert.gov/cas/techalerts/TA10-068A.html https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-017 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7888 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 10.0EPSS: 86%CPEs: 15EXPL: 0CVE-2010-0263 – Microsoft Office Excel XLSX File Parsing Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2010-0263
Microsoft Office Excel 2007 SP1 and SP2; Office 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; and Office SharePoint Server 2007 SP1 and SP2 do not validate ZIP headers during decompression of Open XML (.XLSX) documents, which allows remote attackers to execute arbitrary code via a crafted document that triggers access to uninitialized memory locations, aka "Microsoft Office Excel XLSX File Parsing Code Execution Vulnerability." Microsoft Office Excel 2007 SP1 y SP2; Office 2008 para Mac; Open XML File Format Converter para Mac; Office Excel Viewer SP1 y SP2; Office Compatibility Pack para Word, Excel, y PowerPoint 2007 File Formats SP1 y SP2; y Office SharePoint Server 2007 SP1 y SP2 no validan las cabeceras ZIP durante la descompresión de documentos Open XML (.XLSX), lo que permite a atacantes remotos ejecutar código de su elección a través de un documentos manipulado que provoca el acceso a una ubicación de memoria sin inicializar. También conocida como "Vulnerabilidad Microsoft Office Excel XLSX File Parsing Code Execution". This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Office Excel. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The specific flaw exists in the decompression of XLSX files. • http://www.securityfocus.com/archive/1/509979/100/0/threaded http://www.securitytracker.com/id?1023698 http://www.us-cert.gov/cas/techalerts/TA10-068A.html http://www.zerodayinitiative.com/advisories/ZDI-10-025 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-017 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8407 • CWE-94: Improper Control of Generation of Code ('Code Injection') •