CVE-2010-1253 — Code Injection in Microsoft Excel

CWE-94 — Code Injection5 documents4 sources
Severity
9.3CRITICALNVD
EPSS
61.0%
top 1.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Microsoft ExcelMicrosoft OfficeMicrosoft Office Compatibility Pack
Timeline
PublishedJun 8
Latest updateMay 2

Description

Microsoft Office Excel 2002 SP3, 2007 SP1, and SP2; Office 2004 for mac; Office 2008 for Mac; Open XML File Format Converter for Mac; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2; allows remote attackers to execute arbitrary code via an Excel file with crafted DBQueryExt records that allow a function call to a "user-controlled pointer," aka "Excel ADO Object Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages3 packages

▶NVDmicrosoft/excel2002, 2007+1
▶NVDmicrosoft/office2004, 2008+1

🔴Vulnerability Details

2
GHSA
GHSA-8h7p-v97r-hgw8: Microsoft Office Excel 2002 SP3, 2007 SP1, and SP2; Office 2004 for mac; Office 2008 for Mac; Open XML File Format Converter for Mac; and Office Compa↗2022-05-02
▶
CVEList
CVE-2010-1253: Microsoft Office Excel 2002 SP3, 2007 SP1, and SP2; Office 2004 for mac; Office 2008 for Mac; Open XML File Format Converter for Mac; and Office Compa↗2010-06-08
▶

📋Vendor Advisories

2
Red Hat
kernel: DoS (crash) due slab corruption in inotify_init1 (incomplete fix for CVE-2010-4250)↗2011-04-05
▶
Red Hat
kernel: /sys/kernel/debug/acpi/custom_method can bypass module restrictions↗2011-02-22
▶
CVE-2010-1253 — Code Injection in Microsoft Excel | cvebase