CVE-2011-1279

Current Description

Microsoft Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly validate record information during parsing of Excel spreadsheets, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted spreadsheet, aka "Excel Out of Bounds WriteAV Vulnerability."

Basic Data

PublishedJune 16, 2011
Last ModifiedOctober 12, 2018
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeCWE-119
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityMEDIUM
CVSS 2 - AuthenticationNONE
CVSS 2 - Confidentiality ImpactCOMPLETE
CVSS 2 - Availability ImpactCOMPLETE
CVSS 2 - Base Score9.3
SeverityHIGH
Exploitability Score8.6
Impact Score10.0
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegefalse

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationMicrosoftExcel2002sp3******
    2.3ApplicationMicrosoftExcel2003sp3******
    2.3ApplicationMicrosoftOffice2004*mac*****
    2.3ApplicationMicrosoftOffice2008*mac*****
    2.3ApplicationMicrosoftOpen Xml File Format Converter**mac*****

Vulnerable Software List

VendorProductVersions
Microsoft Open Xml File Format Converter *
Microsoft Office 2004, 2008
Microsoft Excel 2002, 2003

References

NameSourceURLTags
48164http://www.securityfocus.com/bid/48164BID
MS11-045https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-045MS
ms-excel-writeav-ce(67717)https://exchange.xforce.ibmcloud.com/vulnerabilities/67717XF
oval:org.mitre.oval:def:12373https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12373OVAL