CVE-2009-0549 : Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2

Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; and Microsoft Office Excel Viewer 2003 SP3 allow remote attackers to execute arbitrary code via a crafted Excel file with a malformed record object, aka "Record Pointer Corruption Vulnerability."

Published 2009-06-10 18:30:00

Updated 2018-10-12 21:50:26

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2009-0549

Microsoft » Office » Version: XP Update SP3
cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2004 MAC Edition
cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2008 MAC Edition
cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*
Matching versions
Microsoft » Office Compatibility Pack For Word Excel Ppt 2007 » Update SP2
cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Office Compatibility Pack For Word Excel Ppt 2007 » Update SP1
cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Office Sharepoint Server » Version: 2007 Update SP1 X64 Edition
cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp1:x64:*:*:*:*:*
Matching versions
Microsoft » Office Sharepoint Server » Version: 2007 Update SP1 X32 Edition
cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp1:x32:*:*:*:*:*
Matching versions
Microsoft » Office Sharepoint Server » Version: 2007 Update SP2 X32 Edition
cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp2:x32:*:*:*:*:*
Matching versions
Microsoft » Office Sharepoint Server » Version: 2007 Update SP2 X64 Edition
cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp2:x64:*:*:*:*:*
Matching versions
Microsoft » Office Excel Viewer
cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Office Excel Viewer » Version: 2003 Update SP3
cpe:2.3:a:microsoft:office_excel_viewer:2003:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Open Xml File Format Converter » MAC Edition
cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*
Matching versions
Microsoft » Office Excel » Version: 2003 Update SP3
cpe:2.3:a:microsoft:office_excel:2003:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Office Excel » Version: 2000 Update SP3
cpe:2.3:a:microsoft:office_excel:2000:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Office Excel » Version: 2007 Update SP1
cpe:2.3:a:microsoft:office_excel:2007:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Office Excel » Version: 2007 Update SP2
cpe:2.3:a:microsoft:office_excel:2007:sp2:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2009-0549

EPSS FAQ

77.83%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 98 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2009-0549

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2009-0549

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2009-0549

Jump to

Vulnerability Details : CVE-2009-0549

Products affected by CVE-2009-0549

Exploit prediction scoring system (EPSS) score for CVE-2009-0549

CVSS scores for CVE-2009-0549

CWE ids for CVE-2009-0549

References for CVE-2009-0549