CVE-2008-1091

Published: May 13, 2008Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Unspecified vulnerability in Microsoft Word in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 Office System SP1 and earlier allows remote attackers to execute arbitrary code via a Rich Text Format (.rtf) file with a malformed string that triggers a "memory calculation error" and a heap-based buffer overflow, aka "Object Parsing Vulnerability."

Affected (12)

Products: Microsoft: Office, Office Compatibility Pack For Word Excel Ppt 2007, Word Viewer

3 products

Office Compatibility Pack For Word Excel Ppt 2007

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Microsoft Office	Version 2000 sp3
Microsoft Office	Version 2003 sp2
Microsoft Office	Version 2003 sp3
Microsoft Office	Version 2004
Microsoft Office	Version 2007
Microsoft Office	Version 2007_sp1
Microsoft Office	Version 2008
Microsoft Office	Version xp sp3
Microsoft Office Compatibility Pack For Word Excel Ppt 2007	All versions
Microsoft Office Compatibility Pack For Word Excel Ppt 2007	All versions
Microsoft Word Viewer	Version 2003
Microsoft Word Viewer	Version 2003

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (22)

http://marc.info/?l=bugtraq&m=121129490723574&w=2

Source: secure@microsoft.com

http://secunia.com/advisories/30143

Source: secure@microsoft.com

Vendor Advisory

http://www.kb.cert.org/vuls/id/543907

Source: secure@microsoft.com

US Government Resource

http://www.securityfocus.com/archive/1/492020/100/0/threaded

Source: secure@microsoft.com

http://www.securityfocus.com/bid/29104

Source: secure@microsoft.com

http://www.securitytracker.com/id?1020013

Source: secure@microsoft.com

http://www.us-cert.gov/cas/techalerts/TA08-134A.html

Source: secure@microsoft.com

US Government Resource

http://www.vupen.com/english/advisories/2008/1504/references

Source: secure@microsoft.com

http://www.zerodayinitiative.com/advisories/ZDI-08-023

Source: secure@microsoft.com

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-026

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5494

Source: secure@microsoft.com

http://marc.info/?l=bugtraq&m=121129490723574&w=2

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/30143

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.kb.cert.org/vuls/id/543907

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.securityfocus.com/archive/1/492020/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/29104

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1020013

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA08-134A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2008/1504/references

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.zerodayinitiative.com/advisories/ZDI-08-023

Source: af854a3a-2127-422b-91ae-364da2661108

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-026

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5494

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.