CVE-2009-1134

2009-06-1018:30:00

CWE-94

[email protected]

web.nvd.nist.gov

cve-2009-1134

remote code execution

excel

microsoft office

vulnerability

nvd

biff file

record pointer corruption vulnerability

7.3 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.811 High

EPSS

Percentile

98.3%

JSON

Excel in 2007 Microsoft Office System SP1 and SP2; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a BIFF file with a malformed Qsir (0x806) record object, aka “Record Pointer Corruption Vulnerability.”

CPENameOperatorVersion
microsoft:open_xml_file_format_convertermicrosoft open xml file format convertereq*
microsoft:officemicrosoft officeeq2008
microsoft:office_excelmicrosoft office exceleq2007
microsoft:office_sharepoint_servermicrosoft office sharepoint servereq2007
microsoft:officemicrosoft officeeq2004
microsoft:officemicrosoft officeeqxp
microsoft:office_excel_viewermicrosoft office excel viewereq*
microsoft:office_compatibility_pack_for_word_excel_ppt_2007microsoft office compatibility pack for word excel ppt 2007eq*
microsoft:office_excel_viewermicrosoft office excel viewereq2003
microsoft:office_excelmicrosoft office exceleq2003

CPE	Name	Operator	Version
microsoft:open_xml_file_format_converter	microsoft open xml file format converter	eq	*
microsoft:office	microsoft office	eq	2008
microsoft:office_excel	microsoft office excel	eq	2007
microsoft:office_sharepoint_server	microsoft office sharepoint server	eq	2007
microsoft:office	microsoft office	eq	2004
microsoft:office	microsoft office	eq	xp
microsoft:office_excel_viewer	microsoft office excel viewer	eq	*
microsoft:office_compatibility_pack_for_word_excel_ppt_2007	microsoft office compatibility pack for word excel ppt 2007	eq	*
microsoft:office_excel_viewer	microsoft office excel viewer	eq	2003
microsoft:office_excel	microsoft office excel	eq	2003