CVE-2010-1253

Published: Jun 8, 2010Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Microsoft Office Excel 2002 SP3, 2007 SP1, and SP2; Office 2004 for mac; Office 2008 for Mac; Open XML File Format Converter for Mac; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; allows remote attackers to execute arbitrary code via an Excel file with crafted DBQueryExt records that allow a function call to a "user-controlled pointer," aka "Excel ADO Object Vulnerability."

Affected (8)

Products: Microsoft: Excel, Office, Open Xml File Format Converter, Office Compatibility Pack

4 products

Open Xml File Format Converter

Office Compatibility Pack

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Microsoft Excel	Version 2002 sp3
Microsoft Excel	Version 2007 sp1
Microsoft Excel	Version 2007 sp2

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Microsoft Office	Version 2004
Microsoft Office	Version 2008
Microsoft Open Xml File Format Converter	All versions

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Microsoft Office Compatibility Pack	Version 2007 sp1
Microsoft Office Compatibility Pack	Version 2007 sp2

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (12)

http://osvdb.org/65228

Source: secure@microsoft.com

http://www.securityfocus.com/archive/1/511728/100/0/threaded

Source: secure@microsoft.com

http://www.us-cert.gov/cas/techalerts/TA10-159B.html

Source: secure@microsoft.com

US Government Resource

http://www.zerodayinitiative.com/advisories/ZDI-10-103

Source: secure@microsoft.com

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-038

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6842

Source: secure@microsoft.com

http://osvdb.org/65228

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/511728/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA10-159B.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.zerodayinitiative.com/advisories/ZDI-10-103

Source: af854a3a-2127-422b-91ae-364da2661108

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-038

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6842

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.