CVSS: 9.3EPSS: 58%CPEs: 15EXPL: 3CVE-2006-1540 – Microsoft Office Products - Array Index Bounds Error (PoC)
https://notcve.org/view.php?id=CVE-2006-1540
MSO.DLL in Microsoft Office 2000, Office XP (2002), and Office 2003 allows user-assisted attackers to cause a denial of service and execute arbitrary code via multiple attack vectors, as originally demonstrated using a crafted document record with a malformed string, as demonstrated by replacing a certain "01 00 00 00" byte sequence with an "FF FF FF FF" byte sequence, possibly causing an invalid array index, in (1) an Excel .xls document, which triggers an access violation in ole32.dll; (2) an Excel .xlw document, which triggers an access violation in excel.exe; (3) a Word document, which triggers an access violation in mso.dll in winword.exe; and (4) a PowerPoint document, which triggers an access violation in powerpnt.txt. NOTE: after the initial disclosure, this issue was demonstrated by triggering an integer overflow using an inconsistent size for a Unicode "Sheet Name" string. • https://www.exploit-db.com/exploits/1615 http://secunia.com/advisories/21012 http://securitytracker.com/id?1015855 http://www.kb.cert.org/vuls/id/609868 http://www.osvdb.org/27150 http://www.securityfocus.com/archive/1/439697/100/0/threaded http://www.securityfocus.com/bid/17252 http://www.securityfocus.com/bid/18889 http://www.us-cert.gov/cas/techalerts/TA06-192A.html http://www.vupen.com/english/advisories/2006/2756 https://docs.microsoft.com/en-us/sec • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.1EPSS: 69%CPEs: 11EXPL: 1CVE-2006-0030 – Microsoft Excel 95 < 2004 - Malformed Graphic File Code Execution
https://notcve.org/view.php?id=CVE-2006-0030
Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed graphic, which leads to memory corruption. • https://www.exploit-db.com/exploits/27055 http://secunia.com/advisories/19138 http://secunia.com/advisories/19238 http://securitytracker.com/id?1015766 http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm http://www.kb.cert.org/vuls/id/123222 http://www.osvdb.org/23901 http://www.securityfocus.com/bid/16181 http://www.us-cert.gov/cas/techalerts/TA06-073A.html http://www.vupen.com/english/advisories/2006/0950 https://docs.microsoft.com/en-us/security- •
CVSS: 5.1EPSS: 47%CPEs: 13EXPL: 0CVE-2006-0009
https://notcve.org/view.php?id=CVE-2006-0009
Buffer overflow in Microsoft Office 2000 SP3, XP SP3, and other versions and packages, allows user-assisted attackers to execute arbitrary code via a routing slip that is longer than specified by the provided length field, as exploited by malware such as TROJ_MDROPPER.BH and Trojan.PPDropper.E in attacks against PowerPoint. • http://archives.neohapsis.com/archives/fulldisclosure/2006-08/0597.html http://blogs.securiteam.com/?author=28 http://blogs.securiteam.com/?p=557 http://blogs.securiteam.com/?p=559 http://isc.sans.org/diary.php?storyid=1618 http://lists.grok.org.uk/pipermail/full-disclosure/2006-September/049540.html http://secunia.com/advisories/19138 http://secunia.com/advisories/19238 http://securitytracker.com/id? •
CVSS: 5.1EPSS: 70%CPEs: 11EXPL: 0CVE-2006-0029
https://notcve.org/view.php?id=CVE-2006-0029
Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed description, which leads to memory corruption. • http://secunia.com/advisories/19138 http://secunia.com/advisories/19238 http://securityreason.com/securityalert/585 http://securityreason.com/securityalert/586 http://securitytracker.com/id?1015766 http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm http://www.kb.cert.org/vuls/id/235774 http://www.osvdb.org/23900 http://www.us-cert.gov/cas/techalerts/TA06-073A.html http://www.vupen.com/english/advisories/2006/0950 https://docs.microsoft.com/en-us/security-upda •
CVSS: 5.1EPSS: 43%CPEs: 6EXPL: 0CVE-2006-0031
https://notcve.org/view.php?id=CVE-2006-0031
Stack-based buffer overflow in Microsoft Excel 2000, 2002, and 2003, in Microsoft Office 2000 SP3 and other packages, allows user-assisted attackers to execute arbitrary code via an Excel file with a malformed record with a modified length value, which leads to memory corruption. • http://archives.neohapsis.com/archives/fulldisclosure/2006-02/1521.html http://secunia.com/advisories/19138 http://secunia.com/advisories/19238 http://securityreason.com/securityalert/589 http://securitytracker.com/id?1015766 http://support.avaya.com/elmodocs2/security/ASA-2006-069.htm http://www.kb.cert.org/vuls/id/104302 http://www.osvdb.org/23902 http://www.securityfocus.com/archive/1/427699/100/0/threaded http://www.securityfocus.com/bid/17101 http://www.us-cert.g • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •