CVE-2010-0258 Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack fo...
HighCVSS 7.8
EPSS 61.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that causes memory to be interpreted as a different object type than intended, aka "Microsoft Office Excel Sheet Object Type Confusion Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft excel | = 2002-sp3 | No fix listed |
| Microsoft excel | = 2003-sp3 | No fix listed |
| Microsoft excel | = 2007-sp1 | No fix listed |
| Microsoft excel | = 2007-sp2 | No fix listed |
| Microsoft office | = 2004 | No fix listed |
| Microsoft office | = 2008 | No fix listed |
| Microsoft office compatibility pack | = 2007-sp1 | No fix listed |
| Microsoft office compatibility pack | = 2007-sp2 | No fix listed |
| Microsoft office excel viewer | All versions | No fix listed |
| Microsoft office sharepoint server | = 2007-sp1 | No fix listed |
| Microsoft office sharepoint server | = 2007-sp2 | No fix listed |
| Microsoft open xml file format converter | All versions | No fix listed |
References
- 20100309 Microsoft Excel Sheet Object Type Confusion Vulnerability broken-link third-party-advisory
- 1023698 broken-link third-party-advisory vdb-entry
- TA10-068A third-party-advisory us-government-resource
- MS10-017 patch vendor-advisory
- oval:org.mitre.oval:def:8545 broken-link signature vdb-entry