CVE-2009-3135

Published: Nov 11, 2009Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Stack-based buffer overflow in Microsoft Office Word 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, Open XML File Format Converter for Mac, Office Word Viewer 2003 SP3, and Office Word Viewer allow remote attackers to execute arbitrary code via a Word document with a malformed File Information Block (FIB) structure, aka "Microsoft Office Word File Information Memory Corruption Vulnerability."

Affected (7)

Products: Microsoft: Office, Office Word, Office Word Viewer, Open Xml File Format Converter

4 products

Office Word Viewer

Open Xml File Format Converter

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Microsoft Office	Version 2004
Microsoft Office	Version 2008
Microsoft Office Word	Version 2002 sp3
Microsoft Office Word	Version 2003 sp3
Microsoft Office Word Viewer	All versions
Microsoft Office Word Viewer	Version 2003 sp3
Microsoft Open Xml File Format Converter	All versions

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (18)

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=831

Source: secure@microsoft.com

http://osvdb.org/59857

Source: secure@microsoft.com

http://secunia.com/advisories/37277

Source: secure@microsoft.com

Vendor Advisory

http://www.securityfocus.com/bid/36950

Source: secure@microsoft.com

http://www.securitytracker.com/id?1023158

Source: secure@microsoft.com

http://www.us-cert.gov/cas/techalerts/TA09-314A.html

Source: secure@microsoft.com

US Government Resource

http://www.vupen.com/english/advisories/2009/3194

Source: secure@microsoft.com

Vendor Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-068

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6555

Source: secure@microsoft.com

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=831

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/59857

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/37277

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/36950

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1023158

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA09-314A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2009/3194

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-068

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6555

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.