CVE-2013-3889

Published: Oct 9, 2013Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Microsoft Excel 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; Office Compatibility Pack SP3; and Excel Services and Word Automation Services in SharePoint Server 2013 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Excel Memory Corruption Vulnerability."

Affected (18)

Products: Microsoft: Excel, Excel Viewer, Office, Office 2013 Rt, Office Compatibility Pack, Office Web Apps, Sharepoint Server

7 products

Office Compatibility Pack

Office Web Apps

Sharepoint Server

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Microsoft Excel	Version 2010 sp2
Microsoft Excel	Version 2010 sp2
Microsoft Excel	Version 2013
Microsoft Excel	Version 2013
Microsoft Excel Viewer	All versions

Configuration B

7 vulnerable

Vulnerable Software	Affected Versions
Microsoft Office	Version 2007 sp3
Microsoft Office	Version 2010 sp1
Microsoft Office	Version 2010 sp1
Microsoft Office	Version 2011
Microsoft Office	Version 2013
Microsoft Office 2013 Rt	All versions
Microsoft Office Compatibility Pack	All versions

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Microsoft Office Web Apps	Version 2010 sp1
Microsoft Office Web Apps	Version 2010 sp2

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Microsoft Sharepoint Server	Version 2007 sp3
Microsoft Sharepoint Server	Version 2013

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Microsoft Sharepoint Server	Version 2010 sp1
Microsoft Sharepoint Server	Version 2010 sp2

Related CWEs

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (10)

http://www.us-cert.gov/ncas/alerts/TA13-288A

Source: secure@microsoft.com

US Government Resource

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-084

Source: secure@microsoft.com

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-085

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18901

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19132

Source: secure@microsoft.com

http://www.us-cert.gov/ncas/alerts/TA13-288A

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-084

Source: af854a3a-2127-422b-91ae-364da2661108

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-085

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18901

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19132

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.