CVE-2009-0558
published 2009-06-10CVE-2009-0558: Array index error in Excel in Microsoft Office 2000 SP3 and Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac, allows remote attackers…
PriorityP353critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
31.07%
98.1th percentile
Array index error in Excel in Microsoft Office 2000 SP3 and Office 2004 and 2008 for Mac, and Open XML File Format Converter for Mac, allows remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Array Indexing Memory Corruption Vulnerability."
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office_excel | — | — |
| microsoft | office_excel | — | — |
| microsoft | office_excel | — | — |
| microsoft | office_excel_viewer | — | — |
| microsoft | office_sharepoint_server | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
CWE
Access of Memory Location After End of Buffer
mitre_cwe
CWE-788 Access of Memory Location After End of Buffer
CWE-788: Access of Memory Location After End of Buffer
The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.
This typically occurs when a pointer or its index is incremented to a position after the buffer; or when pointer arithmetic results in a position after the buffer.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Confidentiality. Impact: Read Memory. For an out-of-bounds read, the attacker may have access to sensitive information. If the sensitive information contains system details, such as the current buffer's position in memory, this knowledge can be used to craft further attacks, possibly with more severe consequences.
Scope: Integrity, Availability. Impact: Modify Memory, DoS:
CWE
Improper Restriction of Operations within the Bounds of a Memory Buffer
mitre_cwe
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Background: Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced.
Modes of Introduction:
Phase: Implementation
Common Consequences:
Scope: Integrity, Confidentiality, Availability. Impact: Execute Unauthorized Code or Commands, Modify Memory. If the memory accessible by the attacker can be effec
http://osvdb.org/54954http://secunia.com/secunia_research/2009-1/http://www.securityfocus.com/archive/1/504188/100/0/threadedhttp://www.securityfocus.com/bid/35242http://www.securitytracker.com/id?1022351http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlhttp://www.vupen.com/english/advisories/2009/1540https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-021https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11525http://osvdb.org/54954http://secunia.com/secunia_research/2009-1/http://www.securityfocus.com/archive/1/504188/100/0/threadedhttp://www.securityfocus.com/bid/35242http://www.securitytracker.com/id?1022351http://www.us-cert.gov/cas/techalerts/TA09-160A.htmlhttp://www.vupen.com/english/advisories/2009/1540https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-021https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11525
2009-06-10
Published