Vulnerability Name: CVE-2008-4264 (CCN-46862) Assigned: 2008-12-09 Published: 2008-12-09 Updated: 2018-10-12 Summary: Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 Gold and SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed formula, which triggers "pointer corruption" during the loading of formulas from this spreadsheet, aka "File Format Parsing Vulnerability."CVE-2008-4264
CVSS v3 Severity: 10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): ChangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
CVSS v2 Severity: 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C 6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): MediumAuthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C 6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): MediumAthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
Vulnerability Type: CWE-399 Vulnerability Consequences: Gain Access References: Source: MITRECVE-2008-4264 Storage Management Appliance (SMA), Microsoft Patch Applicability MS08-070 to MS08-077 Microsoft Excel Formula, Object, and Global Array Bugs Let Remote Users Execute Arbitrary Code MS08-074 Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (959070) Vulnerability in Microsoft Excel Could Allow Remote Code Execution (2640241) Vulnerability in Microsoft Office Could Allow for Remote Code Execution (2639185) Vulnerability in Microsoft Word Could Allow Remote Code Execution (2680352) Vulnerability in Microsoft Office Could Allow for Remote Code Execution (2731879) Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (2742319) Vulnerability in Microsoft Works Could Allow Remote Code Execution (KB2754670) Vulnerability in Microsoft Word Could Allow Remote Code Execution (2780642) Vulnerability in Microsoft Word Could Allow Remote Code Execution (2830399) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2845537) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2885080) Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (2885084) Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (2916605) Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (2949660) Vulnerability in Microsoft Word Could Allow Remote Code Execution (2969261) Vulnerability in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (3000434) Vulnerability in Microsoft Office Could Allow Remote Code Execution (3009710) Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (3017301) Vulnerabilities in MicrosoftExcel Could Allow Remote Code Execution (3017347) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3080790) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3089664) Security Updates for Microsoft Office (3096440) Security Updates for Microsoft Office to Address Remote Code Execution (3104540) Security Update for Microsoft Office to Address Remote Code Execution (3116111) Security Update for Microsoft Office to Address Remote Code Execution - Critical (3124585) Security Update for Microsoft Office to Address Remote Code Execution (3134226) Security Update for Microsoft Office to Address Remote Code Execution (3141806) Security Update for Microsoft Office (3148775) Security Update for Microsoft Office (3155544) Security Update for Office (3163610) Security Updates for Office (3170008) Security Update for Office (3177451) Security Update for Microsoft Office (3185852) Security Update for Microsoft Office (3194063) Security Update for Microsoft Office (3199168) Security Update for Microsoft Office (3204068) Security Update for Microsoft Office (3214291) Security Update for Microsoft Graphics Component (4013075) Security Update for Microsoft Office (4013241) Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (959070) Vulnerabilities in Microsoft Office Excel Could Cause Remote Code Execution (968557) Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (967340) Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (969462) Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (969514) Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (972652) Vulnerability in Microsoft Office Word Allows Remote Code Execution (976307) Vulnerabilities in Microsoft Office PowerPoint Could Allow Remote Code Execution (975416) Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (980150) Vulnerabilities in COM validation in Microsoft Office Could Allow Remote Code Execution (983235 Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (2027452) Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (2269638) Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution (2269707) Vulnerabilities in Microsoft Word Could Allow Remote Code Execution (2293194) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2423930) Vulnerabilities in Microsoft Office Graphics Filters Could Allow for Remote Code Execution (968095) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2489279) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2489293) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2537146) Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2587505) 32621 Microsoft Excel Formula Handling Remote Code Execution Vulnerability 1021368 TA08-344A ADV-2008-3386 MS08-074 excel-spreadsheet-code-execution(46862) oval:org.mitre.oval:def:5556 Vulnerable Configuration: Configuration 1 :cpe:/a:microsoft:office_excel:2000:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:office_excel:2002:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:office_excel:2003:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:office_excel:2007:*:*:*:*:*:*:* OR cpe:/a:microsoft:office_excel:2007:sp1:*:*:*:*:*:* AND cpe:/a:microsoft:office:2007:*:*:*:*:*:*:* OR cpe:/a:microsoft:office:2007:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:office:2000:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:office:2003:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:office:xp:sp3:*:*:*:*:*:* Configuration 2 :cpe:/a:microsoft:office:2004:*:mac:*:*:*:*:* OR cpe:/a:microsoft:office:2008:*:mac:*:*:*:*:* OR cpe:/a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:*:*:*:*:*:*:* OR cpe:/a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:* OR cpe:/a:microsoft:office_excel_viewer:2003:*:*:*:*:*:*:* OR cpe:/a:microsoft:office_excel_viewer:2003:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:* Configuration CCN 1 :cpe:/a:microsoft:excel_viewer:2003:*:*:*:*:*:*:* OR cpe:/a:microsoft:excel:2007:*:*:*:*:*:*:* OR cpe:/a:microsoft:office_compatibility_pack:2007:*:*:*:*:*:*:* OR cpe:/a:microsoft:excel:2000:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:excel:2002:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:excel_viewer:*:*:*:*:*:*:*:* OR cpe:/a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:excel:2007:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:excel:2003:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:office:2004::~~~mac_os~~:*:*:*:*:* Oval Definitions BACK
microsoft office excel 2000 sp3
microsoft office excel 2002 sp3
microsoft office excel 2003 sp3
microsoft office excel 2007
microsoft office excel 2007 sp1
microsoft 20007 office system *
microsoft 20007 office system sp1
microsoft office 2000 sp3
microsoft office 2003 sp3
microsoft office xp sp3
microsoft office 2004
microsoft office 2008
microsoft office compatibility pack for word excel ppt 2007 *
microsoft office compatibility pack for word excel ppt 2007 * sp1
microsoft office excel viewer *
microsoft office excel viewer 2003
microsoft office excel viewer 2003 sp3
microsoft open xml file format converter *
microsoft excel viewer 2003
microsoft excel 2007
microsoft office compatibility pack 2007
microsoft excel 2000 sp3
microsoft excel 2002 sp3
microsoft excel viewer 2003 sp3
microsoft excel viewer *
microsoft office compatibility pack 2007 sp1
microsoft excel 2007 sp1
microsoft excel 2003 sp3
microsoft office 2004
Denotes that component is vulnerable