CVE-2014-2778

2014-06-1104:56:20

CWE-119

microsoft

web.nvd.nist.gov

microsoft word

office compatibility pack

cve-2014-2778

embedded font vulnerability

memory corruption

remote code execution

denial of service

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

8.7

Confidence

High

EPSS

0.523

Percentile

97.6%

JSON

Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted embedded font in a (1) .doc or (2) .docx document, aka “Embedded Font Vulnerability.”

Affected configurations

Nvd

Node

microsoftoffice_compatibility_packsp3

microsoftwordMatch2007sp3

VendorProductVersionCPE
microsoftoffice_compatibility_pack*cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*
microsoftword2007cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	office_compatibility_pack	*	cpe:2.3:a:microsoft:office_compatibility_pack::sp3::::::*
microsoft	word	2007	cpe:2.3:a:microsoft:word:2007:sp3::::::