CVE-2010-0261

Heap-based buffer overflow in Microsoft Office Excel 2007 SP1 and SP2 and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted spreadsheet in which "a MDXSET record is broken up into several records...

CVE-2010-0260

Microsoft Excel MDXTUPLE/MDXSET heap overflow vulnerabilities (CVE-2010-0260, part of MS10-017) affect Excel 2007 SP1/SP2, Excel Viewer SP1/SP2, and the Office Compatibility Pack for Word/Excel/PowerPoint 2007. The issue arises while parsing the MDXTUPLE/MDXSET records in workbook globals, enabli...

CVE-2010-0261

Microsoft Excel MDXSET Record Heap Overflow (CVE-2010-0261) is a remote-code-execution vulnerability affecting Excel 2007 SP1/SP2 and the Office Compatibility Pack for Word/Excel/PowerPoint 2007 File Formats SP1/SP2. The issue stems from parsing an MDXSET record that is broken into multiple recor...

CVE-2010-0257

CVE-2010-0257 is a remote code execution vulnerability in Microsoft Excel 2002 SP3 and Excel XP related to memory corruption when processing EntExU2 records in a crafted Excel file. Exploitation could allow an attacker to take full control of the affected system by convincing a user to open a mal...

CVE-2010-0263

CVE-2010-0263 concerns Microsoft Office Excel XLSX File Parsing Code Execution. The vulnerability arises from insufficient validation of ZIP headers during decompression of Open XML XLSX documents, enabling remote code execution via a crafted file that accesses uninitialized memory. Affected soft...

CVE-2010-0264

Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Microsoft Office Excel DbOrParamQry Record Parsing...

CVE-2010-0262

Microsoft Office Excel 2007 SP1 and SP2 and Office 2004 for Mac do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that triggers access of an uninitialized stack variable, aka "Microsoft Office Excel FNGROUPNAME Record...

Microsoft Excel MDXSet和ContinueFRT12记录堆溢出漏洞（MS10-017）

BUGTRAQ ID: 38552 CVE ID: CVE-2010-0261 Excel是微软Office套件中的电子表格工具。 Excel在解析XSL文件中畸形MDXSet和ContinueFRT12记录时存在堆溢出漏洞，成功利用此漏洞的攻击者可以完全控制受影响的系统。 Microsoft Excel 2007 SP2 Microsoft Excel 2007 SP1 临时解决方法： 使用Microsoft Office文件阻断策略以防止打开未知或不可信任来源的Office 2003及更早版本的文档。 当打开来自未知来源或不可信来源的文件时使用Microsoft...

Microsoft Excel MDXTuple和ContinueFRT12记录堆溢出漏洞（MS10-017）

BUGTRAQ ID: 38551 CVE ID: CVE-2010-0260 Excel是微软Office套件中的电子表格工具。 Excel在解析XSL文件中畸形MDXTuple和ContinueFRT12记录时存在堆溢出漏洞，成功利用此漏洞的攻击者可以完全控制受影响的系统。 Microsoft Excel Viewer SP2 Microsoft Excel Viewer SP1 Microsoft Excel 2007 SP2 Microsoft Excel 2007 SP1 临时解决方法： 使用Microsoft Office文件阻断策略以防止打开未知或不可信任来源的Office...

Microsoft Security Bulletin MS10-017 - Important Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (980150)

Microsoft Security Bulletin MS10-017 - Important Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution 980150 Published: March 09, 2010 Version: 1.0 General Information Executive Summary This security update resolves seven privately reported vulnerabilities in Microsoft Offi...

Microsoft Excel XLSX文件解析远程代码执行漏洞（MS10-017）

BUGTRAQ ID: 38554 CVE ID: CVE-2010-0263 Excel是微软Office套件中的电子表格工具。 XLSX文件是组成新的开放XML文档相关内容的ZIP档案文件。在解压XLSX文件中的某些XML元素时由于没有验证ZIP头，可能会导致执行未初始化的内存。成功利用此漏洞的攻击者可以完全控制受影响的系统。攻击者可随后安装程序；查看、更改或删除数据；或者创建拥有完全用户权限的新帐户。 Microsoft Excel Viewer SP2 Microsoft Excel Viewer SP1 Microsoft Excel 2007 SP2 Microsoft...

Microsoft Excel EntExU2记录内存破坏漏洞（MS10-017）

BUGTRAQ ID: 38547 CVE ID: CVE-2010-0257 Excel是微软Office套件中的电子表格工具。 Excel处理特制Excel文件中畸形EntExU2记录的方式存在内存破坏漏洞。攻击者可以通过诱骗用户打开特制的XLS文件来利用这个漏洞，成功利用此漏洞可以导致完全控制受影响的系统。 Microsoft Excel 2002 SP3 临时解决方法： 不要打开从不可信任来源接收到货从可信任来源意外接收到的Excel文件。 厂商补丁： Microsoft --------- Microsoft已经为此发布了一个安全公告（MS10-017）以及相应补丁:...

Microsoft Excel对象类型混淆远程代码执行漏洞（MS10-017）

BUGTRAQ ID: 38550 CVE ID: CVE-2010-0258 Excel是微软Office套件中的电子表格工具。 Excel在解析XSL文件中畸形BRAI BIFF记录时存在内存破坏漏洞。在这种情况下，多个记录之间所共享的包含有识别对象类型字段的记录可能导致类型混淆。用户受骗打开了特制的Excel文档就可以触发这个漏洞。通过控制所分配堆块边界之外的内存，攻击者就可以控制虚函数调用中所使用的C++对象指针，导致将内存区处理为不同的对象类型，越界访问所分配的对象。 Microsoft Excel Viewer SP2 Microsoft Excel Viewer SP1...

Microsoft Office Excel Multiple Vulnerabilities (980150)

This host is missing a critical security update according to Microsoft Bulletin MS10-017. OpenVAS Vulnerability Test $Id: secpodms10-017.nasl 6538 2017-07-05 11:38:27Z cfischer $ Microsoft Office Excel Multiple Vulnerabilities 980150 Authors: Antu Sanadi Copyright: Copyright c 2010 SecPod,...

PT-2010-2056 · Microsoft · Office Excel Viewer +3

Name of the Vulnerable Software and Affected Versions: Microsoft Office Excel versions 2002 SP3, 2003 SP3, 2007 SP1 and SP2 Office 2004 and 2008 for Mac Open XML File Format Converter for Mac Office Excel Viewer versions SP1 and SP2 Office Compatibility Pack for Word, Excel, and PowerPoint 2007...

iDefense Security Advisory 03.09.10: Microsoft Excel Sheet Object Type Confusion Vulnerability

iDefense Security Advisory 03.09.10 http://labs.idefense.com/intelligence/vulnerabilities/ Mar 09, 2010 I. BACKGROUND Excel is the spreadsheet application included with Microsoft Corp.'s Office productivity software suite. More information is available at the following website:...

Microsoft Excel FNGROUPNAME记录未初始化内存漏洞（MS10-017）

BUGTRAQ ID: 38553 CVE ID: CVE-2010-0262 Excel是微软Office套件中的电子表格工具。 Excel在解析XSL文件中畸形FnGroupName、BuiltInFnGroupCount和FnGrp12记录时存在未初始化内存漏洞，成功利用此漏洞的攻击者可以完全控制受影响的系统。 Microsoft Excel 2007 SP2 Microsoft Excel 2007 SP1 Microsoft Office 2004 for Mac 临时解决方法： 使用Microsoft Office文件阻断策略以防止打开未知或不可信任来源的Office...

VUPEN Security Research - Microsoft Office Excel Record Processing Code Execution Vulnerability

VUPEN Security Research - Microsoft Office Excel Record Processing Code Execution Vulnerability http://www.vupen.com/english/research.php I. BACKGROUND --------------------- "Microsoft Office Excel is a powerful tool you can use to create and format spreadsheets, and analyze and share information...

Microsoft Excel DbOrParamQry对象解析内存破坏漏洞（MS10-017）

BUGTRAQ ID: 38555 CVE ID: CVE-2010-0264 Excel是微软Office套件中的电子表格工具。 Excel在解析包含有畸形DbOrParamQry记录的.XLS文件时存在内存破坏漏洞，用户受骗打开了恶意的.XLS文件就可能导致执行任意代码。 DbOrParamQry记录指定了DbQuery或ParamQry记录，具体取决于之前的记录。记录查询参数（ParamQry）偏移DCh包含有有关ODBC参数化查询的记录，格式如下： /----- Offset Name Size Contents 4 wTypeSql 2 Used for ODBC querie...

CORE-2009-1103: Microsoft Office Excel DbOrParamQry Record Parsing Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ Microsoft Office Excel DbOrParamQry Record Parsing Vulnerability 1. Advisory Information Title: Microsoft Office Excel DbOrParamQry Record Parsing Vulnerability...