Vulnerability Details : CVE-2009-3127
Microsoft Office Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for Mac, Open XML File Format Converter for Mac, and Office Excel Viewer 2003 SP3 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Cache Memory Corruption Vulnerability."
Vulnerability category: Memory CorruptionExecute code
Products affected by CVE-2009-3127
- cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*
- cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2007:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2007:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel_viewer:*:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel_viewer:*:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel_viewer:2003:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:compatibility_pack_word_excel_powerpoint:2007:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:compatibility_pack_word_excel_powerpoint:2007:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2009-3127
39.15%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2009-3127
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2009-3127
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-3127
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6146
-
http://www.us-cert.gov/cas/techalerts/TA09-314A.html
Microsoft Updates for Multiple Vulnerabilities | CISAUS Government Resource
-
http://www.securitytracker.com/id?1023157
GoDaddy Domain Name Search
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-067
Microsoft Security Bulletin MS09-067 - Important | Microsoft Learn
Jump to