Vulnerability Details : CVE-2011-0978
Stack-based buffer overflow in Microsoft Excel 2002 SP3, 2003 SP3, and 2007 SP2; Office 2004 for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary code via vectors related to an axis properties record, and improper incrementing of an array index, aka "Excel Array Indexing Vulnerability."
Vulnerability category: OverflowExecute code
Exploit prediction scoring system (EPSS) score for CVE-2011-0978
Probability of exploitation activity in the next 30 days: 93.50%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2011-0978
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2011-0978
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2011-0978
-
http://www.securitytracker.com/id?1025337
Microsoft Excel Multiple Bugs Let Remote Users Execute Arbitrary Code - SecurityTracker
-
http://www.us-cert.gov/cas/techalerts/TA11-102A.html
Microsoft Updates for Multiple Vulnerabilities | CISAUS Government Resource
-
http://zerodayinitiative.com/advisories/ZDI-11-042/
ZDI-11-042 | Zero Day Initiative
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12439
Repository / Oval Repository
-
http://securityreason.com/securityalert/8231
Microsoft Office Excel Axis Properties Record Parsing Buffer Overflow PoC - CXSecurity.com
-
http://www.vupen.com/english/advisories/2011/0940
Webmail | OVH- OVH
-
http://dvlabs.tippingpoint.com/blog/2011/02/07/zdi-disclosure-microsoft
Threat Intelligence | Digital Vaccine® | ThreatLinQ | Trend Micro
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-021
Microsoft Security Bulletin MS11-021 - Important | Microsoft Docs
Products affected by CVE-2011-0978
- cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2007:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel_viewer:-:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2:*:*:*:*:*:*