VulnerabilityAnalyzed
CVE-2010-3333
Microsoft Office Stack-based Buffer Overflow Vulnerability
KEVHIGH 7.8EPSS 89.5%
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 24 March 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 89.50% probability · 100th percentile
- CISA KEV
- Listed 3 March 2022 · due 24 March 2022
- Weakness
- CWE-787
- Affected
- microsoft/office · microsoft/open xml file format converter
- Source
- secure@microsoft.com
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2010-3333
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880Broken Link
- http://secunia.com/advisories/38521Broken Link
- http://secunia.com/advisories/42144Broken Link
- http://securityreason.com/securityalert/8293Broken Link
- http://www.securityfocus.com/bid/44652Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1024705Broken Link, Third Party Advisory, VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA10-313A.htmlThird Party Advisory, US Government Resource
- http://www.vupen.com/english/advisories/2010/2923Broken Link
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11931Broken Link
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880Broken Link
- http://secunia.com/advisories/38521Broken Link
- http://secunia.com/advisories/42144Broken Link
- http://securityreason.com/securityalert/8293Broken Link
- http://www.securityfocus.com/bid/44652Broken Link, Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id?1024705Broken Link, Third Party Advisory, VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA10-313A.htmlThird Party Advisory, US Government Resource
- http://www.vupen.com/english/advisories/2010/2923Broken Link
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11931Broken Link
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-3333US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.