CVE-2010-3333 Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac all...
HighCVSS 7.8
EPSS 89.4%
CISA KEV
added 2022-03-03 · due 2022-03-24
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."
CISA Known Exploited Vulnerability
- Date added
- 2022-03-03
- Due date (FCEB)
- 2022-03-24
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft office | = 2003-sp3 | No fix listed |
| Microsoft office | = 2004 | No fix listed |
| Microsoft office | = 2007-sp2 | No fix listed |
| Microsoft office | = 2008 | No fix listed |
| Microsoft office | = 2010 | No fix listed |
| Microsoft office | = 2011 | No fix listed |
| Microsoft office | = xp-sp3 | No fix listed |
| Microsoft open xml file format converter | All versions | No fix listed |
References
- 20101109 Microsoft Word RTF File Parsing Stack Buffer Overflow Vulnerability broken-link third-party-advisory
- 38521 broken-link third-party-advisory
- 42144 broken-link third-party-advisory
- 8293 broken-link third-party-advisory
- 44652 broken-link third-party-advisory vdb-entry
- 1024705 broken-link third-party-advisory vdb-entry
- TA10-313A third-party-advisory us-government-resource
- ADV-2010-2923 broken-link vdb-entry
- MS10-087 patch vendor-advisory
- oval:org.mitre.oval:def:11931 broken-link signature vdb-entry
- www.cisa.gov government-resource us-government-resource