CVE-2008-1091
Unspecified vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via a Rich Text Format (.rtf) file with a malformed string that triggers a…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 40.5%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
Unspecified vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via a Rich Text Format (.rtf) file with a malformed string that triggers a "memory calculation error" and a heap-based buffer overflow, aka "Object Parsing Vulnerability."
- CVSS 2.0
- 9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 40.51% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- microsoft/office · microsoft/office compatibility pack for word excel ppt 2007 · microsoft/word viewer
- Source
- secure@microsoft.com
References
- http://marc.info/?l=bugtraq&m=121129490723574&w=2
- http://secunia.com/advisories/30143Vendor Advisory
- http://www.kb.cert.org/vuls/id/543907US Government Resource
- http://www.securityfocus.com/archive/1/492020/100/0/threaded
- http://www.securityfocus.com/bid/29104
- http://www.securitytracker.com/id?1020013
- http://www.us-cert.gov/cas/techalerts/TA08-134A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2008/1504/references
- http://www.zerodayinitiative.com/advisories/ZDI-08-023
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-026
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5494
- http://marc.info/?l=bugtraq&m=121129490723574&w=2
- http://secunia.com/advisories/30143Vendor Advisory
- http://www.kb.cert.org/vuls/id/543907US Government Resource
- http://www.securityfocus.com/archive/1/492020/100/0/threaded
- http://www.securityfocus.com/bid/29104
- http://www.securitytracker.com/id?1020013
- http://www.us-cert.gov/cas/techalerts/TA08-134A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2008/1504/references
- http://www.zerodayinitiative.com/advisories/ZDI-08-023
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-026
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5494
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.