CVE-2008-0116
Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote attackers to execute arbitrary code via malformed tags in rich text, aka "Excel Rich Text Validation Vulnerability."
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 48.2%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Microsoft Excel 2000 SP3 through 2003 SP2, Viewer 2003, Compatibility Pack, and Office 2004 and 2008 for Mac allows user-assisted remote attackers to execute arbitrary code via malformed tags in rich text, aka "Excel Rich Text Validation Vulnerability."
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 48.23% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20, CWE-94
- Affected
- microsoft/excel · microsoft/excel viewer · microsoft/office · microsoft/office compatibility pack for word excel ppt 2007
- Source
- secure@microsoft.com
References
- http://dvlabs.tippingpoint.com/advisory/TPTI-08-03
- http://marc.info/?l=bugtraq&m=120585858807305&w=2
- http://www.securityfocus.com/archive/1/489430/100/0/threaded
- http://www.securityfocus.com/bid/28168Patch
- http://www.securitytracker.com/id?1019586
- http://www.us-cert.gov/cas/techalerts/TA08-071A.htmlPatch, US Government Resource
- http://www.vupen.com/english/advisories/2008/0846/referencesVendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-014
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5212
- http://dvlabs.tippingpoint.com/advisory/TPTI-08-03
- http://marc.info/?l=bugtraq&m=120585858807305&w=2
- http://www.securityfocus.com/archive/1/489430/100/0/threaded
- http://www.securityfocus.com/bid/28168Patch
- http://www.securitytracker.com/id?1019586
- http://www.us-cert.gov/cas/techalerts/TA08-071A.htmlPatch, US Government Resource
- http://www.vupen.com/english/advisories/2008/0846/referencesVendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-014
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5212
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.