Microsoft Excel FORMAT record array index memory corruption

Added: 09/24/2008 CVE: CVE-2008-3005 BID: 30639 OSVDB: 47408 Background Microsoft Excel, part of the Microsoft Office product suite, is a spreadsheet application for Windows and Macintosh platforms. Problem A memory corruption vulnerability allows command execution when a user opens a spreadsheet...

Microsoft GDI+ VML Heap-Based Buffer Overflow Vulnerability

Description Microsoft GDI+ is prone to a heap-based buffer-overflow vulnerability because the vector graphics link library improperly processes gradient sizes. Successfully exploiting this issue would allow an attacker to corrupt heap memory and execute arbitrary code in the context of the...

Microsoft GDI+ WMF Image File Buffer Overflow Vulnerability

Description Microsoft GDI+ is prone to a buffer-overflow vulnerability because the vector graphics linked library improperly allocates memory when parsing WMF image files. Successfully exploiting this issue would allow an attacker to corrupt memory and execute arbitrary code in the context of the...

Microsoft GDI+ GIF File Parsing Remote Code Execution Vulnerability

Description Microsoft GDI+ is prone to a remote code-execution vulnerability because the vector graphics link library improperly parses GIF image files. An attacker could exploit this issue to execute arbitrary code with the privileges of the currently logged-in user. Failed exploit attempts may...

Microsoft Excel凭据缓存漏洞（MS08-043）

BUGTRAQ ID: 30641 CVECAN ID: CVE-2008-3003 Excel是Microsoft Office办公软件套件中的电子表格工具。 Excel在实现访问认证时存在漏洞，如果.xlsx文件配置为不保存远程数据会话口令的话，Excel就无法正确地从connections.xml删除PWD字符串，这允许用户获得敏感信息并获得对远程数据源的访问。 Microsoft Excel 2007 SP1 Microsoft Excel 2007 Microsoft Office 2008 for Mac 临时解决方法： 在.xlsx文件内编辑connections...

Microsoft Excel Could Allow Remote Code Execution Vulnerabilities (954066)

This host is missing critical security update according to Microsoft Bulletin MS08-043. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft Excel Could Allow Remote Code Execution Vulnerabilities (954066)

This host is missing critical security update according to Microsoft Bulletin MS08-043. OpenVAS Vulnerability Test $Id: secpodms08-043900028.nasl 6538 2017-07-05 11:38:27Z cfischer $ Description: Microsoft Excel Could Allow Remote Code Execution Vulnerabilities 954066 Authors: Chandan S Copyright...

Microsoft Excel索引验证远程代码执行漏洞（MS08-043）

BUGTRAQ ID: 30638 CVECAN ID: CVE-2008-3004 Excel是Microsoft Office办公软件套件中的电子表格工具。 Excel在将Excel文件加载到内存时没有正确地验证电子表格内嵌图表中的AxesSet记录，如果XLS文件中包含有越界的数组值的话，则用户受骗打开了该文件的话就可能触发内存破坏，导致执行任意指令。 Microsoft Excel Viewer 2003 Microsoft Excel 2003 SP3 Microsoft Excel 2003 SP2 Microsoft Excel 2002 SP3 Microsoft Exc...

Microsoft Office Products Detection (Windows SMB Login)

SMB login-based detection of Microsoft Office Products. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Microsoft Excel FORMAT记录无效数组索引漏洞（MS08-043）

BUGTRAQ ID: 30639 CVECAN ID: CVE-2008-3005 Excel是Microsoft Office办公软件套件中的电子表格工具。 Excel没有正确地处理电子表格中的FORMAT记录，如果电子表格中包含有越界数组索引的话，则打开该文件就会导致Excel向栈内存的任意位置写入一个字节，成功利用这个漏洞允许以当前登录用户的权限执行任意指令。 Microsoft Excel 2002 SP3 Microsoft Excel 2000 SP3 Microsoft Office 2008 for Mac Microsoft Office 2004 for Mac...

Microsoft Excel COUNTRY记录内存破坏漏洞（MS08-043）

BUGTRAQ ID: 30640 CVECAN ID: CVE-2008-3006 Excel是Microsoft Office办公软件套件中的电子表格工具。 Excel没有正确地处理BIFF文件格式，在处理文件中的畸形Country（0x8c）记录时可能会触发内存破坏，导致以当前登录用户的权限执行任意指令。 Microsoft Excel Viewer 2003 SP3 Microsoft Excel Viewer 2003 Microsoft Excel Viewer Microsoft Excel 2007 SP1 Microsoft Excel 2007 Microsoft...

ZDI-08-048: Microsoft Excel COUNTRY Record Memory Corruption Vulnerability

ZDI-08-048: Microsoft Excel COUNTRY Record Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-08-048 August 12, 2008 -- CVE ID: CVE-2008-3006 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Office Excel -- TippingPointTM IPS Customer Protection:...

MS08-043: Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (954066)

The remote host is running a version of Microsoft Excel that is subject to various flaws that could allow arbitrary code to be run. An attacker may use this to execute arbitrary code on this host. To succeed, the attacker would have to send a rogue file to a user of the remote computer and have i...

Microsoft Office / Word / Excel / Power Point multiple security vulnerabilities

Multiple memory corruptions, protection bypass...

iDefense Security Advisory 08.12.08: Microsoft Excel FORMAT Record Invalid Array Index Vulnerability

iDefense Security Advisory 08.12.08 http://labs.idefense.com/intelligence/vulnerabilities/ Aug 12, 2008 I. BACKGROUND Microsoft Excel is the spreadsheet application that is included with Microsoft Corp.'s Office productivity software suite. More information is available at the following website...

iDefense Security Advisory 08.12.08: Microsoft Excel Chart AxesSet Invalid Array Index Vulnerability

iDefense Security Advisory 08.12.08 http://labs.idefense.com/intelligence/vulnerabilities/ Aug 12, 2008 I. BACKGROUND Microsoft Excel is the spreadsheet application that is included with Microsoft Corp.'s Office productivity software suite. More information is available at the following website...

CVE-2008-3004

Microsoft Office Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3; Office Excel Viewer 2003; and Office 2004 and 2008 for Mac do not properly validate index values for AxesSet records when loading Excel files, which allows remote attackers to execute arbitrary code via a crafted Excel file, aka the...

CVE-2008-3005

Array index vulnerability in Microsoft Office Excel 2000 SP3 and 2002 SP3, and Office 2004 and 2008 for Mac allows remote attackers to execute arbitrary code via an Excel file with a crafted array index for a FORMAT record, aka the "Excel Index Array Vulnerability."...

CVE-2008-3006

Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 Gold and SP3; Office Excel Viewer; Office Compatibility Pack 2007 Gold and SP1; Office SharePoint Server 2007 Gold and SP1; and Office 2004 and 2008 for Mac do not properly parse Country...

Format string

Array index vulnerability in Microsoft Office Excel 2000 SP3 and 2002 SP3, and Office 2004 and 2008 for Mac allows remote attackers to execute arbitrary code via an Excel file with a crafted array index for a FORMAT record, aka the "Excel Index Array Vulnerability."...