« Volver al listado

CVE-2008-4265

Estado: ModificadaAlta (9.3)—

Microsoft Office Excel 2000 SP3 allows remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed object, which triggers memory corruption during the loading of records from this spreadsheet, aka "File Format Parsing Vulnerability."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Microsoft — OfficeMicrosoft — Office Compatibility Pack FOR Word Excel PPT 2007Microsoft — Office ExcelMicrosoft — Office Excel ViewerMicrosoft — Open XML File Format Converter

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2008-4265",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-12-10T14:00:01.097",
  "references": [
    {
      "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=763",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1021368",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/3386",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-074",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5614",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=763",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1021368",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2008/3386",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-074",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5614",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-399"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Office Excel 2000 SP3 allows remote attackers to execute arbitrary code via a crafted Excel spreadsheet that contains a malformed object, which triggers memory corruption during the loading of records from this spreadsheet, aka \"File Format Parsing Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Microsoft Office Excel 2000 SP3 permite a atacantes remotos ejecutar código de su elección mediante una hoja de cálculo manipulada que contiene un objeto malformado, lo que dispara una corrupción de memoria durante la carga de registros desde esta hoja de cálculo, alias \"Vulnerabilidad de Análisis de Formato de Fichero\"."
    }
  ],
  "lastModified": "2026-06-16T22:57:30.933",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:office_excel:2000:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "806086B6-AB83-4008-A1A2-73BC35A95925"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_excel:2002:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECDF1C1D-EF63-4A3E-AEE2-2D2D9FDBF368"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_excel:2003:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD22DBA8-40B0-4197-9D56-38D5D9E1ED89"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_excel:2007:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3BCABD31-F406-4184-97AF-21AD95353D26"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_excel:2007:sp1:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "297A9F48-13DF-4042-AC21-B8B764B217BE"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:20007_office_system:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B507F860-5D28-4E86-8F61-FC71F4C030C3"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:20007_office_system:sp1:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F9A0B1B7-21A7-4038-8738-02AFADAAB06D"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4891122F-AD7F-45E6-98C6-833227916F6B"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A332D04D-CC8C-4F68-A261-BA2F2D8EAD1E"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "79BA1175-7F02-4435-AEA6-1BA8AADEB7EF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9409A9BD-1E9B-49B8-884F-8FE569D8AA25"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5BA91840-371C-4282-9F7F-B393F785D260"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CD97FF64-64A5-467C-B352-45B89B4A6536"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34C5FEAD-4B4B-44EB-9F3A-05093347A2F1"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_excel_viewer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A2613CE-C469-43AE-A590-87CE1FAADA8B"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_excel_viewer:2003:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0BB3D66F-9028-4703-9D6A-629331EEB492"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_excel_viewer:2003:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B18C291F-57C2-4328-8FCF-3C1A27B0D18D"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3807A4E4-EB58-47B6-AD98-6ED464DEBA4E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "evaluatorComment": "http://www.microsoft.com/technet/security/Bulletin/MS08-074.mspx\r\n\r\n\t\r\nFile Format Parsing Vulnerability - CVE-2008-4265\r\n\r\nA remote code execution vulnerability exists in Microsoft Office Excel as a result of memory corruption when loading Excel records. The vulnerability could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed object. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.",
  "sourceIdentifier": "secure@microsoft.com"
}