CVE-2006-3864

2006-10-1022:07:00

CWE-94

[email protected]

web.nvd.nist.gov

cve-2006-3864

microsoft office

mso.dll

remote code execution

memory corruption

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.2 High

AI Score

Confidence

Low

0.841 High

EPSS

Percentile

98.5%

JSON

Unspecified vulnerability in mso.dll in Microsoft Office 2000, XP, and 2003, and Microsoft PowerPoint 2000, XP, and 2003, allows remote user-assisted attackers to execute arbitrary code via a malformed record in a (1) .DOC, (2) .PPT, or (3) .XLS file that triggers memory corruption, related to an “array boundary condition” (possibly an array index overflow), a different vulnerability than CVE-2006-3434, CVE-2006-3650, and CVE-2006-3868.

Affected configurations

NVD

Node

microsoftofficeMatch2000sp3

microsoftofficeMatch2003sp1

microsoftofficeMatch2003sp2

microsoftofficeMatch2004mac

microsoftofficeMatchv.xmac

microsoftofficeMatchxpsp3

microsoftprojectMatch2000sr1

microsoftprojectMatch2002sp1

microsoftvisioMatch2002sp2

CPENameOperatorVersion
microsoft:officemicrosoft officeeq2000
microsoft:officemicrosoft officeeq2003
microsoft:officemicrosoft officeeq2004
microsoft:officemicrosoft officeeqv.x
microsoft:officemicrosoft officeeqxp
microsoft:projectmicrosoft projecteq2000
microsoft:projectmicrosoft projecteq2002
microsoft:visiomicrosoft visioeq2002

CPE	Name	Operator	Version
microsoft:office	microsoft office	eq	2000
microsoft:office	microsoft office	eq	2003
microsoft:office	microsoft office	eq	2004
microsoft:office	microsoft office	eq	v.x
microsoft:office	microsoft office	eq	xp
microsoft:project	microsoft project	eq	2000
microsoft:project	microsoft project	eq	2002
microsoft:visio	microsoft visio	eq	2002