CVE-2011-1272

Current Description

Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 do not properly validate record structures during parsing of Excel spreadsheets, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Insufficient Record Validation Vulnerability."

Basic Data

PublishedJune 16, 2011
Last ModifiedOctober 12, 2018
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeCWE-20
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityMEDIUM
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactCOMPLETE
CVSS 2 - Availability ImpactCOMPLETE
CVSS 2 - Base Score9.3
SeverityHIGH
Exploitability Score8.6
Impact Score10.0
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegefalse

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationMicrosoftExcel2002sp3******
    2.3ApplicationMicrosoftExcel2003sp3******
    2.3ApplicationMicrosoftExcel2007sp2******
    2.3ApplicationMicrosoftExcel Viewer*sp2******
    2.3ApplicationMicrosoftOffice2004*mac*****
    2.3ApplicationMicrosoftOffice2008*mac*****
    2.3ApplicationMicrosoftOffice Compatibility Pack2007sp2******
    2.3ApplicationMicrosoftOpen Xml File Format Converter**mac*****

Vulnerable Software List

VendorProductVersions
Microsoft Office Compatibility Pack 2007
Microsoft Open Xml File Format Converter *
Microsoft Excel Viewer *
Microsoft Office 2004, 2008
Microsoft Excel 2002, 2003, 2007

References

NameSourceURLTags
48157http://www.securityfocus.com/bid/48157BID
MS11-045https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-045MS
oval:org.mitre.oval:def:12139https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12139OVAL