CVE-2012-1887

2012-11-1400:55:01

CWE-399

[email protected]

web.nvd.nist.gov

cve-2012-1887

microsoft excel

use-after-free vulnerability

remote code execution

crafted spreadsheet

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.5 High

AI Score

Confidence

Low

0.932 High

EPSS

Percentile

99.1%

JSON

Use-after-free vulnerability in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1, and Office 2008 and 2011 for Mac, allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka “Excel SST Invalid Length Use After Free Vulnerability.”

Affected configurations

NVD

Node

microsoftexcelMatch2003sp3

microsoftexcelMatch2007sp2

microsoftexcelMatch2007sp3

microsoftexcelMatch2010sp1x64

microsoftexcelMatch2010sp1x86

microsoftofficeMatch2008mac

microsoftofficeMatch2011mac

CPENameOperatorVersion
microsoft:excelmicrosoft exceleq2003
microsoft:excelmicrosoft exceleq2007
microsoft:excelmicrosoft exceleq2010
microsoft:officemicrosoft officeeq2008
microsoft:officemicrosoft officeeq2011

CPE	Name	Operator	Version
microsoft:excel	microsoft excel	eq	2003
microsoft:excel	microsoft excel	eq	2007
microsoft:excel	microsoft excel	eq	2010
microsoft:office	microsoft office	eq	2008
microsoft:office	microsoft office	eq	2011