Lucene search

[email protected]CVE-2009-1134

HistoryJun 10, 2009 - 6:30 p.m.

CVE-2009-1134

2009-06-1018:30:00

CWE-94

[email protected]

web.nvd.nist.gov

cve-2009-1134

remote code execution

excel

microsoft office

vulnerability

nvd

biff file

record pointer corruption vulnerability

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.4 High

AI Score

Confidence

Low

0.768 High

EPSS

Percentile

98.2%

JSON

Excel in 2007 Microsoft Office System SP1 and SP2; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a BIFF file with a malformed Qsir (0x806) record object, aka “Record Pointer Corruption Vulnerability.”

Affected configurations

NVD

Node

microsoftofficeMatch2004mac

microsoftofficeMatch2008mac

microsoftofficeMatchxpsp3

microsoftoffice_compatibility_pack_for_word_excel_ppt_2007sp1

microsoftoffice_compatibility_pack_for_word_excel_ppt_2007sp2

microsoftoffice_excelMatch2000sp3

microsoftoffice_excelMatch2003sp3

microsoftoffice_excelMatch2007sp1

microsoftoffice_excelMatch2007sp2

microsoftoffice_excel_viewer

microsoftoffice_excel_viewerMatch2003sp3

microsoftoffice_sharepoint_serverMatch2007sp1x32

microsoftoffice_sharepoint_serverMatch2007sp1x64

microsoftoffice_sharepoint_serverMatch2007sp2x32

microsoftoffice_sharepoint_serverMatch2007sp2x64

microsoftopen_xml_file_format_convertermac

CPENameOperatorVersion
microsoft:officemicrosoft officeeq2004
microsoft:officemicrosoft officeeq2008
microsoft:officemicrosoft officeeqxp
microsoft:office_compatibility_pack_for_word_excel_ppt_2007microsoft office compatibility pack for word excel ppt 2007eq*
microsoft:office_excelmicrosoft office exceleq2000
microsoft:office_excelmicrosoft office exceleq2003
microsoft:office_excelmicrosoft office exceleq2007
microsoft:office_excel_viewermicrosoft office excel viewereq*
microsoft:office_excel_viewermicrosoft office excel viewereq2003
microsoft:office_sharepoint_servermicrosoft office sharepoint servereq2007

CPE	Name	Operator	Version
microsoft:office	microsoft office	eq	2004
microsoft:office	microsoft office	eq	2008
microsoft:office	microsoft office	eq	xp
microsoft:office_compatibility_pack_for_word_excel_ppt_2007	microsoft office compatibility pack for word excel ppt 2007	eq	*
microsoft:office_excel	microsoft office excel	eq	2000
microsoft:office_excel	microsoft office excel	eq	2003
microsoft:office_excel	microsoft office excel	eq	2007
microsoft:office_excel_viewer	microsoft office excel viewer	eq	*
microsoft:office_excel_viewer	microsoft office excel viewer	eq	2003
microsoft:office_sharepoint_server	microsoft office sharepoint server	eq	2007