CVE-2007-0028
Microsoft Excel 2000, 2002, 2003, Viewer 2003, Office 2004 for Mac, and Office v.X for Mac does not properly handle certain opcodes, which allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file, which results in an…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 33.2%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Microsoft Excel 2000, 2002, 2003, Viewer 2003, Office 2004 for Mac, and Office v.X for Mac does not properly handle certain opcodes, which allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file, which results in an "Improper Memory Access Vulnerability." NOTE: an early disclosure of this issue used CVE-2006-3432, but only CVE-2007-0028 should be used.
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 33.19% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- microsoft/excel · microsoft/office · microsoft/excel viewer · microsoft/works
- Source
- secure@microsoft.com
References
- http://secunia.com/advisories/23676Vendor Advisory
- http://securitytracker.com/id?1017485
- http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-30.html
- http://www.fortinet.com/FortiGuardCenter/advisory/FGA-2007-01.html
- http://www.kb.cert.org/vuls/id/493185Patch, US Government Resource
- http://www.osvdb.org/31249
- http://www.securityfocus.com/archive/1/457274/100/0/threaded
- http://www.securityfocus.com/bid/21952
- http://www.us-cert.gov/cas/techalerts/TA07-009A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/0103Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-002
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A768
- http://secunia.com/advisories/23676Vendor Advisory
- http://securitytracker.com/id?1017485
- http://www.fortinet.com/FortiGuardCenter/advisory/FG-2006-30.html
- http://www.fortinet.com/FortiGuardCenter/advisory/FGA-2007-01.html
- http://www.kb.cert.org/vuls/id/493185Patch, US Government Resource
- http://www.osvdb.org/31249
- http://www.securityfocus.com/archive/1/457274/100/0/threaded
- http://www.securityfocus.com/bid/21952
- http://www.us-cert.gov/cas/techalerts/TA07-009A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/0103Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-002
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A768
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.