CVSS: 9.3EPSS: 46%CPEs: 11EXPL: 0CVE-2009-0238
https://notcve.org/view.php?id=CVE-2009-0238
Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC. Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3 y 2007 SP1; Excel Viewer 2003 Gold y SP3; Excel Viewer; Compatibility Pack para Word, Excel y PowerPoint 2007 File Formats SP1; y Excel de Microsoft Office 2004 y 2008 para Mac; permiten a atacantes remotos ejecutar código de su elección a través de un documento Excel manipulado que provoca un intento de acceso a un objeto no válido, tal y como se ha explotado libremente en Febrero 2009 por MDropper.XR. • http://blogs.zdnet.com/security/?p=2658 http://isc.sans.org/diary.html?storyid=5923 http://securitytracker.com/id?1021744 http://www.microsoft.com/technet/security/advisory/968272.mspx http://www.securityfocus.com/bid/33870 http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-022310-4202-99 http://www.us-cert.gov/cas/techalerts/TA09-104A.html http://www.vupen.com/english/advisories/2009/1023 https://docs.microsoft.com/en-us/security-updates/securitybulletins • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.5EPSS: 59%CPEs: 10EXPL: 0CVE-2008-4252
https://notcve.org/view.php?id=CVE-2008-4252
The DataGrid ActiveX control in Microsoft Visual Basic 6.0 and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "DataGrid Control Memory Corruption Vulnerability." El control ActiveX DataGrid de Microsoft Visual Basic 6.0 y Visual FoxPro 8.0 SP1, y 9.0 SP1 y SP2, no maneja adecuadamente los errores en el acceso a objetos no iniciados correctamente, esto permite a atacantes remotos ejecutar código de su elección a través de un documento HTML manipulado; está relacionado con la corrupción del "estado del sistema". También se como "Vulnerabilidad de Corrupción en el Control de Memoria DataGrid". • http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm http://www.securityfocus.com/bid/32591 http://www.securitytracker.com/id?1021369 http://www.us-cert.gov/cas/techalerts/TA08-344A.html http://www.vupen.com/english/advisories/2008/3382 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5894 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.3EPSS: 90%CPEs: 18EXPL: 0CVE-2008-4265
https://notcve.org/view.php?id=CVE-2008-4265
Microsoft Office Excel 2000 SP3 allows remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed object, which triggers memory corruption during the loading of records from this spreadsheet, aka "File Format Parsing Vulnerability." Microsoft Office Excel 2000 SP3 permite a atacantes remotos ejecutar código de su elección mediante una hoja de cálculo manipulada que contiene un objeto malformado, lo que dispara una corrupción de memoria durante la carga de registros desde esta hoja de cálculo, alias "Vulnerabilidad de Análisis de Formato de Fichero". • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=763 http://www.securitytracker.com/id?1021368 http://www.us-cert.gov/cas/techalerts/TA08-344A.html http://www.vupen.com/english/advisories/2008/3386 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-074 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5614 • CWE-399: Resource Management Errors •
CVSS: 8.5EPSS: 64%CPEs: 10EXPL: 0CVE-2008-4256
https://notcve.org/view.php?id=CVE-2008-4256
The Charts ActiveX control in Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 and 2003 SP1, and Visual FoxPro 8.0 SP1 and 9.0 SP1 and SP2 does not properly handle errors during access to incorrectly initialized objects, which allows remote attackers to execute arbitrary code via a crafted HTML document, related to corruption of the "system state," aka "Charts Control Memory Corruption Vulnerability." El control ActiveX Charts en Microsoft Visual Basic 6.0, Visual Studio .NET 2002 SP1 y 2003 SP1, y Visual FoxPro 8.0 SP1 y 9.0 SP1 y SP2 no maneja adecuadamente errores durante el acceso de objetos inicializados incorrectamente, lo que permite a atacantes remotos ejecutar código de su elección a través de documentos HTML manipulados, relacionados con la corrupción del "estado del sistema," también conocido como vulnerabilidad de corrupción de memoria en el control de caracteres." • http://support.avaya.com/elmodocs2/security/ASA-2008-473.htm http://www.securityfocus.com/bid/32614 http://www.securitytracker.com/id?1021369 http://www.us-cert.gov/cas/techalerts/TA08-344A.html http://www.vupen.com/english/advisories/2008/3382 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-070 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5651 • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 53%CPEs: 19EXPL: 0CVE-2008-4030
https://notcve.org/view.php?id=CVE-2008-4030
Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Outlook 2007 Gold and SP1; Word Viewer 2003 Gold and SP3; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1 allow remote attackers to execute arbitrary code via crafted control words in (1) an RTF file or (2) a rich text e-mail message, which triggers incorrect memory allocation and memory corruption, aka "Word RTF Object Parsing Vulnerability," a different vulnerability than CVE-2008-4028. Microsoft Office Word 2000 SP3, 2002 SP3, 2003 SP3, y 2007 Gold y SP1; Outlook 2007 Gold y SP1; Word Viewer 2003 Gold y SP3; y Office Compatibility Pack para Word, Excel, y PowerPoint 2007 File Formats Gold y SP1, permiten a atacantes remotos ejecutar código de su elección a través de palabras de control manipuladas en ficheros (1) RTF o (2) e-mail con texto enriquecido, lo que provoca una asignación incorrecta de memoria y una corrupción de memoria, también conocida como "Vulnerabilidad Word RTF Object Parsing". Vulnerabilidad diferente de CVE-2008-4028. • http://www.securitytracker.com/id?1021370 http://www.us-cert.gov/cas/techalerts/TA08-344A.html http://www.vupen.com/english/advisories/2008/3384 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-072 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5737 • CWE-399: Resource Management Errors •