fkie_cve-2010-3333
Vulnerability from fkie_nvd
Published
2010-11-10 03:00
Modified
2025-02-10 17:15
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."
References
secure@microsoft.comhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880Broken Link
secure@microsoft.comhttp://secunia.com/advisories/38521Broken Link
secure@microsoft.comhttp://secunia.com/advisories/42144Broken Link
secure@microsoft.comhttp://securityreason.com/securityalert/8293Broken Link
secure@microsoft.comhttp://www.securityfocus.com/bid/44652Broken Link, Third Party Advisory, VDB Entry
secure@microsoft.comhttp://www.securitytracker.com/id?1024705Broken Link, Third Party Advisory, VDB Entry
secure@microsoft.comhttp://www.us-cert.gov/cas/techalerts/TA10-313A.htmlThird Party Advisory, US Government Resource
secure@microsoft.comhttp://www.vupen.com/english/advisories/2010/2923Broken Link
secure@microsoft.comhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087Patch, Vendor Advisory
secure@microsoft.comhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11931Broken Link
af854a3a-2127-422b-91ae-364da2661108http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880Broken Link
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/38521Broken Link
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/42144Broken Link
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/8293Broken Link
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/44652Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id?1024705Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.us-cert.gov/cas/techalerts/TA10-313A.htmlThird Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2010/2923Broken Link
af854a3a-2127-422b-91ae-364da2661108https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11931Broken Link
Impacted products
Vendor Product Version
microsoft office 2003
microsoft office 2004
microsoft office 2007
microsoft office 2008
microsoft office 2010
microsoft office 2011
microsoft office xp
microsoft open_xml_file_format_converter -


To clipboard 

{
   cisaActionDue: "2022-03-24",
   cisaExploitAdd: "2022-03-03",
   cisaRequiredAction: "Apply updates per vendor instructions.",
   cisaVulnerabilityName: "Microsoft Office Stack-based Buffer Overflow Vulnerability",
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*",
                     matchCriteriaId: "A332D04D-CC8C-4F68-A261-BA2F2D8EAD1E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:office:2004:*:*:*:*:macos:*:*",
                     matchCriteriaId: "0B191155-67F2-4C6E-BD0C-AF5AF6F04BA1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*",
                     matchCriteriaId: "08AF794A-435D-4171-9DBB-EB7FAED96DBA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*",
                     matchCriteriaId: "421ACF1B-1B21-4416-98ED-BAA5C210EAE5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:office:2010:*:*:*:*:*:*:*",
                     matchCriteriaId: "6F68DBEC-7A95-43B4-9174-79F89FC93BC5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:office:2011:*:*:*:*:macos:*:*",
                     matchCriteriaId: "BCB90D64-B7B2-4301-91E3-A113569371F2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*",
                     matchCriteriaId: "79BA1175-7F02-4435-AEA6-1BA8AADEB7EF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:microsoft:open_xml_file_format_converter:-:*:*:*:*:macos:*:*",
                     matchCriteriaId: "4BC69733-551E-4535-B851-4A3EF71E98CD",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka \"RTF Stack Buffer Overflow Vulnerability.\"",
      },
      {
         lang: "es",
         value: "Desbordamiento de búfer basado en pila en Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 y 2008 para Mac, Office para Mac 2011 y Open XML File Format Converter para Mac permite a atacantes remotos ejecutar código de su elección mediante datos RTF manipulados, también conocido como \"RTF Stack Buffer Overflow Vulnerability.\"",
      },
   ],
   id: "CVE-2010-3333",
   lastModified: "2025-02-10T17:15:09.133",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "COMPLETE",
               baseScore: 9.3,
               confidentialityImpact: "COMPLETE",
               integrityImpact: "COMPLETE",
               vectorString: "AV:N/AC:M/Au:N/C:C/I:C/A:C",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 10,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            type: "Secondary",
         },
      ],
   },
   published: "2010-11-10T03:00:02.087",
   references: [
      {
         source: "secure@microsoft.com",
         tags: [
            "Broken Link",
         ],
         url: "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880",
      },
      {
         source: "secure@microsoft.com",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/38521",
      },
      {
         source: "secure@microsoft.com",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/42144",
      },
      {
         source: "secure@microsoft.com",
         tags: [
            "Broken Link",
         ],
         url: "http://securityreason.com/securityalert/8293",
      },
      {
         source: "secure@microsoft.com",
         tags: [
            "Broken Link",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/44652",
      },
      {
         source: "secure@microsoft.com",
         tags: [
            "Broken Link",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securitytracker.com/id?1024705",
      },
      {
         source: "secure@microsoft.com",
         tags: [
            "Third Party Advisory",
            "US Government Resource",
         ],
         url: "http://www.us-cert.gov/cas/techalerts/TA10-313A.html",
      },
      {
         source: "secure@microsoft.com",
         tags: [
            "Broken Link",
         ],
         url: "http://www.vupen.com/english/advisories/2010/2923",
      },
      {
         source: "secure@microsoft.com",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087",
      },
      {
         source: "secure@microsoft.com",
         tags: [
            "Broken Link",
         ],
         url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11931",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/38521",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://secunia.com/advisories/42144",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://securityreason.com/securityalert/8293",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/44652",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securitytracker.com/id?1024705",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "US Government Resource",
         ],
         url: "http://www.us-cert.gov/cas/techalerts/TA10-313A.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "http://www.vupen.com/english/advisories/2010/2923",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Vendor Advisory",
         ],
         url: "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
         ],
         url: "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11931",
      },
   ],
   sourceIdentifier: "secure@microsoft.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-787",
            },
         ],
         source: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
         type: "Secondary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.