CVE-2009-1134 : Excel in 2007 Microsoft Office System SP1 and SP2; Microsoft Office Excel Viewer

Excel in 2007 Microsoft Office System SP1 and SP2; Microsoft Office Excel Viewer; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allow remote attackers to execute arbitrary code via a BIFF file with a malformed Qsir (0x806) record object, aka "Record Pointer Corruption Vulnerability."

Published 2009-06-10 18:30:00

Updated 2018-10-12 21:51:01

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2009-1134

Microsoft » Office » Version: XP Update SP3
cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2004 MAC Edition
cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2008 MAC Edition
cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*
Matching versions
Microsoft » Office Compatibility Pack For Word Excel Ppt 2007 » Update SP2
cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Office Compatibility Pack For Word Excel Ppt 2007 » Update SP1
cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Office Sharepoint Server » Version: 2007 Update SP1 X64 Edition
cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp1:x64:*:*:*:*:*
Matching versions
Microsoft » Office Sharepoint Server » Version: 2007 Update SP1 X32 Edition
cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp1:x32:*:*:*:*:*
Matching versions
Microsoft » Office Sharepoint Server » Version: 2007 Update SP2 X32 Edition
cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp2:x32:*:*:*:*:*
Matching versions
Microsoft » Office Sharepoint Server » Version: 2007 Update SP2 X64 Edition
cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp2:x64:*:*:*:*:*
Matching versions
Microsoft » Office Excel Viewer
cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Office Excel Viewer » Version: 2003 Update SP3
cpe:2.3:a:microsoft:office_excel_viewer:2003:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Open Xml File Format Converter » MAC Edition
cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*
Matching versions
Microsoft » Office Excel » Version: 2003 Update SP3
cpe:2.3:a:microsoft:office_excel:2003:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Office Excel » Version: 2000 Update SP3
cpe:2.3:a:microsoft:office_excel:2000:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Office Excel » Version: 2007 Update SP1
cpe:2.3:a:microsoft:office_excel:2007:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Office Excel » Version: 2007 Update SP2
cpe:2.3:a:microsoft:office_excel:2007:sp2:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2009-1134

EPSS FAQ

76.83%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 98 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2009-1134

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2009-1134

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2009-1134

Jump to

Vulnerability Details : CVE-2009-1134

Products affected by CVE-2009-1134

Exploit prediction scoring system (EPSS) score for CVE-2009-1134

CVSS scores for CVE-2009-1134

CWE ids for CVE-2009-1134

References for CVE-2009-1134