CVE-2010-0262 Microsoft Office Excel 2007 SP1 and SP2 and Office 2004 for Mac do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that trig...
HighCVSS 9.3
EPSS 21.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Microsoft Office Excel 2007 SP1 and SP2 and Office 2004 for Mac do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that triggers access of an uninitialized stack variable, aka "Microsoft Office Excel FNGROUPNAME Record Uninitialized Memory Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft excel | = 2002-sp3 | No fix listed |
| Microsoft excel | = 2003-sp3 | No fix listed |
| Microsoft excel | = 2007-sp1 | No fix listed |
| Microsoft excel | = 2007-sp2 | No fix listed |
| Microsoft office | = 2004 | No fix listed |
| Microsoft office | = 2008 | No fix listed |
| Microsoft office compatibility pack | = 2007-sp1 | No fix listed |
| Microsoft office compatibility pack | = 2007-sp2 | No fix listed |
| Microsoft office excel viewer | All versions | No fix listed |
| Microsoft office sharepoint server | = 2007-sp1 | No fix listed |
| Microsoft office sharepoint server | = 2007-sp2 | No fix listed |
| Microsoft open xml file format converter | All versions | No fix listed |
References
- 20100309 Microsoft Excel FNGROUPNAME Record Uninitialized Memory Vulnerability third-party-advisory
- 1023698 vdb-entry
- TA10-068A third-party-advisory us-government-resource
- MS10-017 vendor-advisory
- oval:org.mitre.oval:def:8562 signature vdb-entry