CVE-2008-3477 — Improper Input Validation in Microsoft Internet Explorer

CWE-399CWE-20 — Improper Input Validation3 documents3 sources
Severity
9.3CRITICALNVD
EPSS
71.3%
top 1.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft Internet Explorer
Timeline
PublishedOct 15
Latest updateMay 2

Description

Microsoft Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3 does not properly validate data in the VBA Performance Cache when processing an Office document with an embedded object, which allows remote attackers to execute arbitrary code via an Excel file containing a crafted value, leading to heap-based buffer overflows, integer overflows, array index errors, and memory corruption, aka "Calendar Object Validation Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages1 packages

▶NVDmicrosoft/internet_explorer5.01, 6, 7+2

Patches

Patch: secunia.com ↗Patch: www.securityfocus.com ↗Patch: secunia.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-xpwf-6m43-7f68: Microsoft Excel 2000 SP3, 2002 SP3, and 2003 SP2 and SP3 does not properly validate data in the VBA Performance Cache when processing an Office docume↗2022-05-02
▶

📐Framework References

1
CWE
Improper Input Validation↗
▶
CVE-2008-3477 — Improper Input Validation in Microsoft | cvebase