Buffer overflow in Microsoft Office Compatibility Pack
CVE-2013-3847
Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3848, CVE-2013-3849, and CVE-2013-3858.
Vulnerability class: Buffer Overflow
EPSS: 0.210 (97.4th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Office_compatibility_pack
- Microsoft Office_web_apps — versions 2010
- Microsoft Sharepoint_foundation — versions 2010
- Microsoft Sharepoint_portal_server — versions 2003
- Microsoft Sharepoint_server — versions 2010
- Microsoft Sharepoint_services — versions 2.0, 3.0
- Microsoft Word — versions 2003, 2007, 2010
- Microsoft Word_viewer
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secure@microsoft.com (signature, x_refsource_OVAL, vdb-entry)
- secure@microsoft.com (signature, x_refsource_OVAL, vdb-entry)
- secure@microsoft.com (x_refsource_MS, vendor-advisory)
- secure@microsoft.com (x_refsource_MS, vendor-advisory)
- secure@microsoft.com (US Government Resource, Third Party Advisory, x_refsource_CERT, third-party-advisory)
Frequently asked questions
- What is CVE-2013-3847?
- CVE-2013-3847 is a vulnerability in Microsoft Office Compatibility Pack, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2013-09-11.
- Is CVE-2013-3847 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.