CVE-2010-3333

CVE-2010-3333 is a stack-based buffer overflow in Microsoft Office’s RTF parser (pFragments shape property) that enables remote code execution via crafted RTF data. Affected products include Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office for Mac 2004/2008, Office for Mac 201...

CVE-2006-2492

CVE-2006-2492 is a buffer overflow in Microsoft Word (Office 2000 SP3, XP SP3, 2003 SP1/SP2) and Microsoft Works through 2006 caused by a malformed object pointer. The flaw allows arbitrary code execution and requires user interaction (via opening a crafted Word/Works document). Affected products...

CVE-2009-0557

CVE-2009-0557 describes an Object Record Corruption vulnerability in Microsoft Office Excel across multiple platforms (Office 2000 SP3, XP SP3, 2003 SP3, Mac editions, and Excel Viewer/Compatibility Pack). The root cause is a malformed record object in an Excel file, enabling remote code executio...

CVE-2009-0563

CVE-2009-0563 is a Stack-based buffer overflow in Microsoft Word components that allows remote code execution when a user opens a crafted Word document with an invalid length field. Affected products include Word 2002 SP3, 2003 SP3, Word 2007 SP1/SP2, Office for Mac 2004/2008, Open XML File Forma...

CVE-2009-2500

This CVE corresponds to MS09-062: GDI+ WMF Integer Overflow Vulnerability. Affected are Microsoft GDI+ image-processing paths used by WMF, PNG, TIFF, BMP handling across Windows components and Office/Viewer products (e.g., IE6, Office suites, Visio, Project, SQL/Report Viewer, Forefront Client Se...

CVE-2004-0200

CVE-2004-0200 is a buffer-overflow vulnerability in the JPEG parsing engine of Microsoft GDI+ (GDIPlus.dll). The flaw allows remote code execution when a specially crafted JPEG image is processed, with the attack vector involving JPEG data that is mis-sized during a memory copy. The vulnerability...

CVE-2009-2528

CVE-2009-2528 is a memory corruption vulnerability in GDI+ used by Microsoft Office XP/2000 when parsing Office Art Property Tables. A crafted Office document can trigger remote code execution. Microsoft Security Bulletin MS09-062 (KB957488) provides patches; apply the MS09-062 updates to remedia...

CVE-2008-1434

CVE-2008-1434 describes a remote code execution vulnerability in Microsoft Word caused by a memory handling error when processing a Word file containing a malformed CSS value. The issue affects Word across multiple products/versions (Office 2000 SP3, Word 2000; Word XP SP3; Word 2003 SP2/SP3; Wor...

CVE-2009-3126

CVE-2009-3126 corresponds to the GDI+ PNG Integer Overflow vulnerability described in MS09-062. The issue arises from an integer overflow in GDI+ when processing PNG images, which could allow remote code execution if a user opens a specially crafted image. The vulnerability affects a wide range o...

CVE-2007-5348

The CVE-2007-5348 entry concerns an IMAGE processing vulnerability in Microsoft GDI+ that could enable remote code execution. The connected KB954593 article MS08-052 describes multiple vulnerabilities in GDI+ across Windows and Office components that could be exploited by viewing a specially craf...

CVE-2006-0002

CVE-2006-0002 is a TNEF decoding vulnerability in Microsoft Outlook (2000–2003) and Microsoft Exchange Server (5.0 SP2, 5.5 SP4, 2000 SP3) where processing a crafted TNEF MIME attachment can lead to remote code execution. Root cause described as improper handling/validation of TNEF data, enabling...

CVE-2009-0562

CVE-2009-0562 describes a heap memory corruption in the Office Web Components ActiveX control (OWC10.DataSourceControl) used by Office XP/2003 Web Components and related components. The vulnerability could allow remote code execution when a user loads a malicious page that loads/unloads the contr...

CVE-2009-2501

CVE-2009-2501 describes a heap-based buffer overflow in Microsoft GDI+ when processing PNG images, enabling remote code execution via crafted PNGs. Affected software/contexts include Internet Explorer 6 SP1 on Windows XP (SP2/SP3) and various Microsoft Office components and viewers that rely on G...

CVE-2009-2502

CVE-2009-2502 is a GDI+ TIFF buffer overflow vulnerability that could allow remote code execution when processing a specially crafted TIFF image. The vulnerability affects multiple Microsoft products enabled via Internet Explorer 6 SP1, various Windows and Office suites, Viewer components, and re...

CVE-2008-3013

CVE-2008-3013 corresponds to a GDI+ GIF parsing vulnerability. The connected KB954593 (MS08-052) describes remote code execution in Windows GDI+ when a user views a specially crafted GIF, affecting multiple Windows versions and Office components. The underlying issue is memory corruption during G...

CVE-2010-0815

CVE-2010-0815 (VBE6.DLL Stack Memory Corruption) is a remote code execution vulnerability in Microsoft Visual Basic for Applications (VBA) related to how VBA searches for ActiveX controls embedded in documents. The issue affects Office XP SP3, Office 2003 SP3, 2007 Office System SP1/SP2, VBA, and...

CVE-2010-1263

CVE-2010-1263 is a remote code execution vulnerability in the COM object validation during instantiation in Windows Shell and WordPad. The issue affects Windows XP SP3, Windows XPx64 SP2, Windows Server 2003 SP2 and x64 Itanium editions, Windows Vista SP1/SP2, Windows Server 2008 SP2, and Windows...

CVE-2009-2496

CVE-2009-2496 : Heap-based/heap corruption vulnerability in the OWC10.Spreadsheet ActiveX control of Microsoft Office Web Components. Exploitation requires a user to load a malicious web page and trigger a specific sequence of method calls, leading to remote code execution. Affected products incl...

CVE-2008-3014

CVE-2008-3014 is the GDI+ WMF Buffer Overrun vulnerability. A buffer overflow in gdiplus.dll (GDI+) allows remote code execution when processing a malformed WMF image, affecting multiple Windows and Office components listed in the description (e.g., Internet Explorer 6 SP1 on various Windows vers...

CVE-2009-2504

CVE-2009-2504 corresponds to MS09-062: multiple remote code execution vulnerabilities in Windows GDI+ exposed via GDI+ APIs used by .NET Framework and Office components. The issue stems from integer overflows/buffer handling in GDI+, enabling remote code execution when rendering crafted images in...

CVE-2008-1089

CVE-2008-1089 (Visio Object Header Vulnerability) affects Microsoft Visio 2002 SP2, 2003 SP2/SP3, and 2007 up to SP1. The flaw stems from improper validation of object header data when opening Visio files, which could allow a remote attacker to execute arbitrary code on a vulnerable system. Explo...

CVE-2009-2503

CVE-2009-2503 is a GDI+ memory corruption vulnerability in Microsoft components that can be triggered by a crafted TIFF image file, enabling remote code execution. The weakness resides in how GDI+ allocates memory when processing TIFFs, affecting a wide range of Windows and Office products listed...

CVE-2006-1540

Mode C: The CVE-2006-1540 issue affects Microsoft Office 2000, XP (2002), and 2003. It stems from a memory corruption vulnerability caused by malformed strings in Office Document files, enabling user‑assisted execution of arbitrary code and potential denial of service when opening crafted Excel, ...

CVE-2006-3877

PowerPoint Malformed Record Memory Corruption Vulnerability (CVE-2006-3877) affects multiple Office suites. A remote code execution flaw exists when PowerPoint opens a specially crafted file with malformed records, allowing an attacker to gain full control of the affected system if the user runs ...

CVE-2009-1534

CVE-2009-1534 : Buffer overflow in the Office Web Components ActiveX Control used by Microsoft Office Web Components across multiple products (Office XP/2000 Web Components SP3, BizTalk Server 2002, Visual Studio .NET 2003 SP1) enables remote code execution via crafted property values. The issue ...

CVE-2007-0671

CVE-2007-0671 is a remote-code-execution vulnerability in Microsoft Office Excel (affecting Excel 2000/XP/2003 and Mac equivalents) where a specially crafted Excel file can trigger arbitrary code execution. The vulnerability arises from improper handling/parsing of office records, enabling remote...

CVE-2006-1316

CVE-2006-1316 is a Microsoft Office memory-corruption vulnerability described as a parsing issue in Office files that triggers memory corruption in various Office products (Office 2000/XP/2003 SP1/SP2). Connected advisories indicate this family includes a related CVE-2006-2389 (Office Property Vu...

CVE-2006-5994

CVE-2006-5994 is a remote-code-execution vulnerability in Microsoft Word (2000, 2002, Word Viewer 2003, Word 2003, and Word on Mac 2004/2004 v. X; also affects Works 2004–2006). The root cause, per the connected materials, is that Word does not sufficiently validate certain strings when processin...

CVE-2008-1090

CVE-2008-1090 is a Visio memory validation vulnerability in Microsoft Visio 2002 SP2, 2003 SP2/SP3, and 2007 up to SP1. A remote attacker could exploit memory allocation handling when loading specially crafted .DXF files from disk, leading to remote code execution if a user opens the file. The vu...

CVE-2008-3015

CVE-2008-3015 (GDI+ BMP Integer Overflow) describes a vulnerability in gdiplus.dll where a BMP BitMapInfoHeader with malformed data can trigger a buffer overflow, enabling remote code execution. Affected products include Office XP SP3, Office 2003 SP2/SP3, Office 2007, Visio 2002 SP2, PowerPoint ...

CVE-2007-0515

CVE-2007-0515 affects Microsoft Word via a Section Table/Table Stream buffer overflow in Word documents. The vulnerability allows memory corruption that, per sources, enabled remote code execution on Word 2000 (and denial of service on Word 2003) when users open a crafted .doc file. Root cause: S...

CVE-2008-3012

CVE-2008-3012 corresponds to an in-GDI+ memory allocation flaw in gdiplus.dll that could allow remote code execution when a specially crafted EMF image is viewed. Connected docs confirm this as MS08-052, addressing vulnerabilities in GDI+ across Windows and Office components (IE6, Windows XP, Ser...

CVE-2005-2127

CVE-2005-2127 is a remote code-execution vulnerability in Internet Explorer 5.01/5.5/6 related to memory corruption when instantiating certain COM objects not designed for IE. The issue, documented as COM Object Instantiation Memory Corruption, affects multiple CLSIDs (e.g., Msdds.dll, Blnmgrps.d...

CVE-2004-0848

CVE-2004-0848 corresponds to a buffer overflow in Microsoft Office XP that can allow remote code execution via specially crafted HTML links referencing URL file locations. Connected advisories detail that the overflow occurs in the Office process handling URL file references, enabling arbitrary c...

CVE-2006-0007

CVE-2006-0007 is described in connected advisories as a Linux kernel vulnerability (2.6.9–2.6.20) where the key_alloc_serial function allows remote DoS via vectors triggering a null dereference (spinlock CPU recursion). Remediation is to upgrade to the fixed kernel version (2.6.19.3 per the chang...

CVE-2006-6456

CVE-2006-6456 is a remote code execution flaw in Microsoft Word 2000, Word 2002, Word 2003 and Word Viewer 2003 caused by malformed data structures in Word files. Attackers could exploit via specially crafted Word files (e.g., attachments or web-hosted content) to execute arbitrary code with the ...

CVE-2009-0561

The CVE-2009-0561 issue is a heap-based buffer overflow in Microsoft Excel triggered while parsing a Shared String Table (SST) record when a numeric field specifies an invalid number of unique strings. Affects multiple Windows/macOS Excel versions across Office 2000–2008 and related viewers/compa...

CVE-2006-2389

CVE-2006-2389 is a memory-corruption vulnerability in Microsoft Office 2003 SP1/SP2, Office XP SP3, Office 2000 SP3, and other Office products triggered by a malformed Office property within a file, leading to arbitrary code execution when a user opens the crafted document. Connected advisories c...

CVE-2003-0347

Vulnerability CVE-2003-0347 affects Microsoft Visual Basic for Applications (VBA) 5.0–6.3 via heap-based overflow in VBE.DLL and VBE6.DLL. An attacker could supply a document with a long ID parameter to cause remote code execution. Impact is remote compromise with user privileges; affected compon...

CVE-2004-0121

Technical details about CVE-2004-0121 are not publicly available in the provided connected documents. The material only restates the issue in Outlook 2002 without specifics. Monitor for updates.

CVE-2008-3004

The CVE-2008-3004 issue affects Microsoft Office Excel and related Mac/Viewer builds. It arises from improper validation of AxesSet index values when loading Excel files, allowing remote code execution via a specially crafted XLS document. Affected products include Excel 2000 SP3, 2002 SP3, 2003 ...

CVE-2006-0031

CVE-2006-0031 (MS06-012 family) is a stack-based buffer overflow in Microsoft Excel 2000/XP/2003 triggered by parsing a crafted Excel file containing a malformed record length, leading to memory corruption and potential remote code execution. The vulnerability is one of several Excel-related issu...

CVE-2010-3336

CVE-2010-3336 is a remote code execution vulnerability in Microsoft Office (MSO Large SPID Read AV Vulnerability). The MS10-087 bulletin documents this family of Office memory-corruption flaws, affecting Office XP SP3, Office 2003/2004/2007/2010 on Windows, Office for Mac 2011, and Open XML File ...

CVE-2008-3006

Microsoft Excel could allow remote code execution via memory corruption in the BIFF COUNTRY record parsing bug. Affected products include Excel 2000 SP3, 2002 SP3, 2003 SP2/SP3, 2007 Gold/SP1; Excel Viewer; Office Compatibility Pack 2007 Gold/SP1; Office for Mac (2004/2008); and SharePoint Server...

CVE-2010-0243

The CVE-2010-0243 issue is a remote code execution vulnerability in MSO.DLL affecting Microsoft Office XP SP3 and Microsoft Office 2004 for Mac, caused by a memory corruption/buffer overflow when loading specially crafted Office files (OfficeArtSpgr containers). The OpenVAS/Core advisories confir...

CVE-2010-3947

The CVE-2010-3947 issue is a heap-based buffer overflow in the TIFF Image Converter used by Microsoft Office’s graphics filters, affecting Office XP SP3, Office Converter Pack, and Works 9. A crafted TIFF image can trigger remote code execution via the TIFF import/export filter in Office document...

CVE-2009-2518

CVE-2009-2518 is an integer overflow vulnerability in Microsoft GDI+ when processing BMP headers in Office documents. Exploitation could allow remote code execution if a user opens a specially crafted Office BMP-containing file, with the root cause being a memory corruption/heap overflow in BMP h...

CVE-2007-1747

CVE-2007-1747 concerns a remote code execution in Microsoft Office via a malformed drawing object parsed by MSO.dll. The vulnerability affects multiple Office versions across platforms: Office 2000 SP3, Office 2002 SP3, Office 2003 SP2, Office 2004 for Mac, and Office 2007, where parsing a specia...

CVE-2006-4694

The CVE-2006-4694 entry concerns a vulnerability in Microsoft PowerPoint (Office 2000/XP/2003) where malformed PowerPoint records, specifically NamedShows, are not properly handled. A crafted .PPT file can enable user‑assisted code execution in the context of the logged‑in user, with exploit acti...

CVE-2007-1201

CVE-2007-1201 is a remote code execution vulnerability in Microsoft Office Web Components 2000 related to the DataSource handling that can trigger memory corruption. Multiple sources describe the DataSource Vulnerability as allowing an attacker to execute arbitrary code in the user’s context by v...