CVE-2006-3864
Unspecified vulnerability in mso.dll in Microsoft Office 2000, XP, and 2003, and Microsoft PowerPoint 2000, XP, and 2003, allows remote user-assisted attackers to execute arbitrary code via a malformed record in a (1) .DOC, (2) .PPT, or (3) .XLS file…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 34.0%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Unspecified vulnerability in mso.dll in Microsoft Office 2000, XP, and 2003, and Microsoft PowerPoint 2000, XP, and 2003, allows remote user-assisted attackers to execute arbitrary code via a malformed record in a (1) .DOC, (2) .PPT, or (3) .XLS file that triggers memory corruption, related to an "array boundary condition" (possibly an array index overflow), a different vulnerability than CVE-2006-3434, CVE-2006-3650, and CVE-2006-3868.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 33.95% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- microsoft/office · microsoft/project · microsoft/visio
- Source
- secure@microsoft.com
References
- http://secunia.com/advisories/22339Vendor Advisory
- http://securitytracker.com/id?1017034
- http://secway.org/advisory/AD20061010.txt
- http://support.microsoft.com/kb/922581
- http://www.kb.cert.org/vuls/id/176556US Government Resource
- http://www.osvdb.org/29429
- http://www.securityfocus.com/archive/1/448268/100/0/threaded
- http://www.securityfocus.com/archive/1/449179/100/0/threaded
- http://www.securityfocus.com/bid/20384
- http://www.vupen.com/english/advisories/2006/3981Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-062
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A632
- http://secunia.com/advisories/22339Vendor Advisory
- http://securitytracker.com/id?1017034
- http://secway.org/advisory/AD20061010.txt
- http://support.microsoft.com/kb/922581
- http://www.kb.cert.org/vuls/id/176556US Government Resource
- http://www.osvdb.org/29429
- http://www.securityfocus.com/archive/1/448268/100/0/threaded
- http://www.securityfocus.com/archive/1/449179/100/0/threaded
- http://www.securityfocus.com/bid/20384
- http://www.vupen.com/english/advisories/2006/3981Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-062
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A632
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.