CVE-2006-3435
PowerPoint in Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac does not properly parse the slide notes field in a document, which allows remote user-assisted attackers to execute arbitrary code via crafted data in this field, which…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 37.4%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
PowerPoint in Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac does not properly parse the slide notes field in a document, which allows remote user-assisted attackers to execute arbitrary code via crafted data in this field, which triggers an erroneous object pointer calculation that uses data from within the document. NOTE: this issue is different than other PowerPoint vulnerabilities including CVE-2006-4694.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 37.38% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- microsoft/office
- Source
- secure@microsoft.com
References
- http://securitytracker.com/id?1017030
- http://www.kb.cert.org/vuls/id/187028US Government Resource
- http://www.osvdb.org/29446
- http://www.securityfocus.com/archive/1/448149/100/0/threaded
- http://www.securityfocus.com/archive/1/449179/100/0/threaded
- http://www.securityfocus.com/bid/20304
- http://www.vupen.com/english/advisories/2006/3977Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-06-032.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-058
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A476
- http://securitytracker.com/id?1017030
- http://www.kb.cert.org/vuls/id/187028US Government Resource
- http://www.osvdb.org/29446
- http://www.securityfocus.com/archive/1/448149/100/0/threaded
- http://www.securityfocus.com/archive/1/449179/100/0/threaded
- http://www.securityfocus.com/bid/20304
- http://www.vupen.com/english/advisories/2006/3977Vendor Advisory
- http://www.zerodayinitiative.com/advisories/ZDI-06-032.html
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-058
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A476
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.