CVE-2006-3649
published 2006-08-09CVE-2006-3649: Buffer overflow in Microsoft Visual Basic for Applications (VBA) SDK 6.0 through 6.4, as used by Microsoft Office 2000 SP3, Office XP SP3, Project 2000 SR1…
PriorityP269medium5.1CVSS 2.0
AVNACHAuNCPIPAP
ITWVulnCheck KEV
Exploited in the wild
EPSS
10.17%
95.1th percentile
Buffer overflow in Microsoft Visual Basic for Applications (VBA) SDK 6.0 through 6.4, as used by Microsoft Office 2000 SP3, Office XP SP3, Project 2000 SR1, Project 2002 SP1, Access 2000 Runtime SP3, Visio 2002 SP2, and Works Suite 2004 through 2006, allows user-assisted attackers to execute arbitrary code via unspecified document properties that are not verified when VBA is invoked to open documents.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | visual_basic | — | — |
| microsoft | visual_basic | — | — |
| microsoft | visual_basic | — | — |
CVSS provenance
nvdv2.05.1MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
vulncheck5.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3hf5-qqhv-2j5x: Buffer overflow in Microsoft Visual Basic for Applications (VBA) SDK 6
ghsa_unreviewed·2022-05-01
CVE-2006-3649 [MEDIUM] GHSA-3hf5-qqhv-2j5x: Buffer overflow in Microsoft Visual Basic for Applications (VBA) SDK 6
Buffer overflow in Microsoft Visual Basic for Applications (VBA) SDK 6.0 through 6.4, as used by Microsoft Office 2000 SP3, Office XP SP3, Project 2000 SR1, Project 2002 SP1, Access 2000 Runtime SP3, Visio 2002 SP2, and Works Suite 2004 through 2006, allows user-assisted attackers to execute arbitrary code via unspecified document properties that are not verified when VBA is invoked to open documents.
VulnCheck
Microsoft visual_basic Out-of-bounds Write
vulncheck·2006·CVSS 5.1
CVE-2006-3649 [MEDIUM] Microsoft visual_basic Out-of-bounds Write
Microsoft visual_basic Out-of-bounds Write
Buffer overflow in Microsoft Visual Basic for Applications (VBA) SDK 6.0 through 6.4, as used by Microsoft Office 2000 SP3, Office XP SP3, Project 2000 SR1, Project 2002 SP1, Access 2000 Runtime SP3, Visio 2002 SP2, and Works Suite 2004 through 2006, allows user-assisted attackers to execute arbitrary code via unspecified document properties that are not verified when VBA is invoked to open documents.
Affected: Microsoft visual_basic
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-047
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://secunia.com/advisories/21408http://securitytracker.com/id?1016656http://www.kb.cert.org/vuls/id/159484http://www.securityfocus.com/bid/19414http://www.us-cert.gov/cas/techalerts/TA06-220A.htmlhttp://www.vupen.com/english/advisories/2006/3214https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-047https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A694http://secunia.com/advisories/21408http://securitytracker.com/id?1016656http://www.kb.cert.org/vuls/id/159484http://www.securityfocus.com/bid/19414http://www.us-cert.gov/cas/techalerts/TA06-220A.htmlhttp://www.vupen.com/english/advisories/2006/3214https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-047https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A694
2006-08-09
Published
Exploited in the wild