Heap overflow

Heap-based buffer overflow in Cerulean Studios Trillian 3.x before 3.1.6.0 allows remote attackers to execute arbitrary code via a message sent through the MSN protocol, or possibly other protocols, with a crafted UTF-8 string, which triggers improper memory allocation for word wrapping when a...

CVE-2007-3305

Heap-based buffer overflow in Cerulean Studios Trillian 3.x before 3.1.6.0 allows remote attackers to execute arbitrary code via a message sent through the MSN protocol, or possibly other protocols, with a crafted UTF-8 string, which triggers improper memory allocation for word wrapping when a...

RHEL 5 : libwpd (RHSA-2007:0055)

Updated libwpd packages to correct a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. libwpd is a library for reading and converting Word Perfect documents. iDefense reported...

Microsoft Word数组数据处理远程代码执行漏洞（MS07-024）

Microsoft Word是Office套件中的文字处理工具。 Microsoft Word在处理数组数据时存在输入验证漏洞，远程攻击者可能利用此漏洞控制用户机器。 Word处理数组中的数据时没有执行充分的验证，如果用户受骗打开了恶意的Word文档的话，就可能导致执行任意代码。 Microsoft Office 2004 for Mac Microsoft Word Viewer 2003 Microsoft Word 2003 SP2 Microsoft Word 2002 SP3 Microsoft Word 2000 SP3 Microsoft Works Suite 2006...

Microsoft Office畸形绘图对象远程代码执行漏洞（MS07-025）

Microsoft Office是非常流行的办公软件套件。 Microsoft Office的MSO.dll库在解析Office绘图对象时没有执行充分的数据验证，如果Office打开了特制的Office文件并解析畸形的绘图对象，就可能破坏系统内存，导致执行任意指令。 Microsoft Office XP SP3 Microsoft Office 2007 Microsoft Office 2004 for Mac Microsoft Office 2003 Service Pack 2 Microsoft Office 2000 Service Pack 3 临时解决方法：...

Microsoft Word RTF解析远程堆破坏漏洞（MS07-024）

Microsoft Word是Office套件中的文字处理工具。 Word在处理RTF文档中某些文字的属性字符串时存在堆破坏漏洞，在某些环境下，这些属性字符串可能被写入到已经释放的内存区域中，触发堆破坏，导致在受影响主机上执行任意指令。 Microsoft Office 2004 for Mac Microsoft Word Viewer 2003 Microsoft Word 2003 SP2 Microsoft Word 2002 SP3 Microsoft Word 2000 SP3 Microsoft Works Suite 2006 Microsoft Works Suite...

Microsoft Word文档流远程代码执行漏洞（MS07-024）

Microsoft Word是Office套件中的文字处理工具。 Microsoft Word在处理畸形格式数据的文档时存在漏洞，远程攻击者可能利用此漏洞通过诱使用户打开恶意文件控制用户机器。 Word在处理带有Word文档流的对象时没有执行充分的验证，如果用户受骗打开了恶意的Word文档的话，就可能触发内存破坏，导致执行任意指令。目前这个漏洞正在被积极的利用。 Microsoft Word 2002 SP3 Microsoft Word 2000 SP3 Microsoft Works Suite 2006 Microsoft Works Suite 2005 Microsoft...

Microsoft Word multiple security vulnerabilities

Array overflows, memory corruptions on streams parsing and RTF parsing...

iDefense Security Advisory 05.08.07: Microsoft Word RTF File Parsing Heap Corruption Vulnerability

Microsoft Word RTF File Parsing Heap Corruption Vulnerability iDefense Security Advisory 05.08.07 http://labs.idefense.com/intelligence/vulnerabilities/ May 08, 2007 I. BACKGROUND Microsoft Word is a word processing application from Microsoft Office. Rich Text Format RTF is a document file format...

Microsoft Word fails to properly parse crafted rich text content

Overview Microsoft Word fails to properly parse rich text content and may allow a remote, unauthenticated attacker to execute arbitrary code. Description Microsoft Word does not properly validate rich text within the contents of a file. When Word opens and parses a specially crafted file, memory...

Design/Logic Flaw

Word or Word Viewer in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, 2004 for Mac, and Works Suite 2004, 2005, and 2006 does not properly parse certain rich text "property strings of certain control words," which allows user-assisted remote attackers to trigger heap corruption and execute arbitrar...

CVE-2007-1202

Word or Word Viewer in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, 2004 for Mac, and Works Suite 2004, 2005, and 2006 does not properly parse certain rich text "property strings of certain control words," which allows user-assisted remote attackers to trigger heap corruption and execute arbitrar...

CVE-2007-1202

Word or Word Viewer in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, 2004 for Mac, and Works Suite 2004, 2005, and 2006 does not properly parse certain rich text "property strings of certain control words," which allows user-assisted remote attackers to trigger heap corruption and execute arbitrar...

CVE-2007-0035

Word or Word Viewer in Microsoft Office 2000 SP3, XP SP3, 2003 SP2, 2004 for Mac, and Works Suite 2004, 2005, and 2006 does not properly handle data in a certain array, which allows user-assisted remote attackers to execute arbitrary code, aka the "Word Array Overflow Vulnerability."...

CVE-2007-0035

CVE-2007-0035 is the Word Array Overflow vulnerability in Microsoft Word/Word Viewer across Office 2000 SP3, XP SP3, 2003 SP2, Word 2004 for Mac, and Works Suite 2004–2006. The issue arises from improper handling of data in a certain array, enabling user-assisted remote code execution when a craf...

MS07-024: Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (934232)

The remote host is running a version of Microsoft Word that could allow arbitrary code to be run. An attacker could use this to execute arbitrary code on this host. To succeed, the attacker would have to send a rogue file to a user of the remote computer and have it open it. Then a bug in the fon...

VulnCheck KEV: CVE-2007-0870

Unspecified vulnerability in Microsoft Word 2000 allows remote attackers to cause a denial of service crash via unknown vectors, a different vulnerability than CVE-2006-5994, CVE-2006-6456, CVE-2006-6561, and CVE-2007-0515, a variant of Exploit-MS06-027...

Microsoft Word Array Remote Code Execution Vulnerability

Description Microsoft Word is prone to a remote code-execution vulnerability. An attacker could exploit this issue by enticing a victim to open a malicious Word file. Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in...

Microsoft Word RTF Parsing Remote Code Execution Vulnerability

Description Microsoft Word is prone to a remote code-execution vulnerability. An attacker could exploit this issue by enticing a victim to open a malicious Word file. Successfully exploiting this issue would allow the attacker to execute arbitrary code in the context of the currently logged-in...

Microsoft Security Bulletin MS07-024 Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (934232)

Microsoft Security Bulletin MS07-024 Vulnerabilities in Microsoft Word Could Allow Remote Code Execution 934232 Published: May 8, 2007 Version: 1.0 Summary Who Should Read this Document: Customers who use Microsoft Word Impact of Vulnerability: Remote Code Execution Maximum Severity Rating:...