CVE-2008-4266

Опубликовано: 10 дек. 2008

Источник: nvd

CVSS2: 9.3

EPSS Средний

Описание

Array index vulnerability in Microsoft Office Excel 2000 SP3, 2002 SP3, and 2003 SP3; Excel Viewer 2003 Gold and SP3; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via an Excel spreadsheet with a NAME record that contains an invalid index value, which triggers stack corruption, aka "Excel Global Array Memory Corruption Vulnerability."

Комментарий

http://www.microsoft.com/technet/security/Bulletin/MS08-074.mspx

Excel Global Array Memory Corruption Vulnerability - CVE-2008-4266

A remote code execution vulnerability exists in Microsoft Office Excel as a result of stack corruption when loading Excel records. The vulnerability could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed object. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:microsoft:excel:2000:sp3:*:*:*:*:*:*

cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:*

cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*

cpe:2.3:a:microsoft:excel_viewer:2003:*:*:*:*:*:*:*

cpe:2.3:a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:*

cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*

cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*

cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*

EPSS

Процентиль: 98%

0.5929

Средний

9.3 Critical

CVSS2

Дефекты

CWE-399

Связанные уязвимости

GHSA-xg67-p862-jx9m

github

почти 4 года назад