critical9.3

CVE-2008-4024

Microsoft Office Word 2000 SP3 and 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a Word document with a crafted lcbPlcf…

Impact

Microsoft Office Word 2000 SP3 and 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a Word document with a crafted lcbPlcfBkfSdt field in the File Information Block (FIB), which bypasses an initialization step and triggers an "arbitrary free," aka "Word Memory Corruption Vulnerability."

Affected products

Vendor	Product	Affected versions
Microsoft	Office	Versions 2004, 2008
Microsoft	Office Compatibility Pack For Word Excel Ppt 2007	All versions
Microsoft	Office Word Viewer	Version 2003
Microsoft	Open Xml File Format Converter	All versions
Microsoft	Works	Version 8.0
Microsoft	Office Outlook	Version 2007
Microsoft	Office Word	Versions 2000, 2002, 2003, 2007

Weakness classification

CWE-94

References

NVD record
CVE.org record
http://www.coresecurity.com/content/word-arbitrary-free
http://www.coresecurity.com/files/attachments/CORE-2008-0228-Word.pdf
http://www.securityfocus.com/archive/1/499086/100/0/threaded
http://www.securitytracker.com/id?1021370
http://www.us-cert.gov/cas/techalerts/TA08-344A.html
http://www.vupen.com/english/advisories/2008/3384
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-072
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5934
http://www.coresecurity.com/content/word-arbitrary-free
http://www.coresecurity.com/files/attachments/CORE-2008-0228-Word.pdf
http://www.securityfocus.com/archive/1/499086/100/0/threaded
http://www.securitytracker.com/id?1021370
http://www.us-cert.gov/cas/techalerts/TA08-344A.html
http://www.vupen.com/english/advisories/2008/3384
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-072
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5934