Vulnerability Details : CVE-2010-0258
Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 do not properly parse the Excel file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that causes memory to be interpreted as a different object type than intended, aka "Microsoft Office Excel Sheet Object Type Confusion Vulnerability."
Vulnerability category: Execute code
Products affected by CVE-2010-0258
- cpe:2.3:a:microsoft:office:2004:*:*:*:*:mac_os_x:*:*
- cpe:2.3:a:microsoft:office:2008:*:*:*:*:macos:*:*
- cpe:2.3:a:microsoft:excel:2002:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2003:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2007:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:excel:2007:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_sharepoint_server:2007:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_excel_viewer:-:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_excel_viewer:-:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_compatibility_pack:2007:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:*:*:*:macos:*:*
Exploit prediction scoring system (EPSS) score for CVE-2010-0258
18.40%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 96 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2010-0258
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST | |
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST | 2024-02-02 |
CWE ids for CVE-2010-0258
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
-
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.Assigned by: nvd@nist.gov (Primary)
References for CVE-2010-0258
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8545
Repository / Oval RepositoryBroken Link
-
http://www.us-cert.gov/cas/techalerts/TA10-068A.html
Microsoft Updates for Multiple Vulnerabilities | CISAThird Party Advisory;US Government Resource
-
http://www.securitytracker.com/id?1023698
Microsoft Office Excel Bugs Let Remote Users Execute Arbitrary Code - SecurityTrackerBroken Link;Third Party Advisory;VDB Entry
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-017
Microsoft Security Bulletin MS10-017 - Important | Microsoft DocsPatch;Vendor Advisory
-
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=859
Broken Link
Jump to