| Vulnerability Name: | CVE-2010-0822 (CCN-58900) | ||||||||
| Assigned: | 2010-06-08 | ||||||||
| Published: | 2010-06-08 | ||||||||
| Updated: | 2018-10-12 | ||||||||
| Summary: | Stack-based buffer overflow in Microsoft Office Excel 2002 SP3, Office 2004 for Mac, Office 2008 for Mac, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file with a crafted OBJ (0x5D) record, aka "Excel Object Stack Overflow Vulnerability." | ||||||||
| CVSS v3 Severity: | 10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
| ||||||||
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C) 7.7 High (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
7.7 High (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:F/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-94 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2010-0822 Source: OSVDB Type: UNKNOWN 65236 Source: CCN Type: SA37500 Microsoft Office Excel Multiple Vulnerabilities Source: CCN Type: Microsoft Security Bulletin MS10-038 Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (2027452) Source: CCN Type: Microsoft Security Bulletin MS10-057 Vulnerability in Microsoft Office Excel Could Allow Remote Code Execution (2269707) Source: CCN Type: OSVDB ID: 65236 Microsoft Office Excel Malformed OBJ Record Handling Overflow Source: BUGTRAQ Type: UNKNOWN 20100608 VUPEN Security Research - Microsoft Office Excel OBJ Stack Overflow Vulnerability (CVE-2010-0822) Source: BID Type: UNKNOWN 40520 Source: CCN Type: BID-40520 Microsoft Excel OBJ Record Stack Overflow Remote Code Execution Vulnerability Source: CERT Type: US Government Resource TA10-159B Source: MS Type: UNKNOWN MS10-038 Source: XF Type: UNKNOWN ms-excel-object-bo(58900) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:7265 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [2010-07-14] Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [09-24-2010] Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [11-22-2011] | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| Oval Definitions | |||||||||
| |||||||||
| BACK | |||||||||