PT-2007-1158 · Microsoft · Windows+3

Fabrice Desclaux + 1 · Published 2007-02-13 · Updated 2018-10-12 · CVE-2006-1311

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions 2000 SP4, XP SP2, and 2003 SP1 Microsoft Office versions 2000 SP3, XP SP3, 2003 SP2, and Office 2004 for Mac Learning Essentials for Microsoft Office versions 1.0, 1.1, and 1.5

Description: A remote code execution issue exists in the RichEdit components provided with Microsoft Windows and Microsoft Office. This issue can be exploited when a user interacts with a malformed embedded OLE object within a Rich Text Format (RTF) file or a Rich Text e-mail message, which triggers memory corruption.

Recommendations: For Microsoft Windows versions 2000 SP4, XP SP2, and 2003 SP1, update to a newer version that contains a fix for this issue. For Microsoft Office versions 2000 SP3, XP SP3, 2003 SP2, and Office 2004 for Mac, update to a newer version that contains a fix for this issue. For Learning Essentials for Microsoft Office versions 1.0, 1.1, and 1.5, update to a newer version that contains a fix for this issue. As a temporary workaround, consider avoiding the use of RichEdit components when interacting with RTF files or Rich Text e-mail messages until a patch is available.

Fix

Related Identifiers

CVE-2006-1311

Affected Products

Learning Essentials For Microsoft Office

Office

Office Visio

Windows

References · 16

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-013 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1311 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2006-1311 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30592 · Note
• http://secunia.com/advisories/24152 · Note
• http://securityfocus.com/bid/21876 · Note
• http://xforce.iss.net/xforce/xfdb/30592 · Note
• http://osvdb.org/31886 · Note
• http://vupen.com/english/advisories/2007/0582 · Note
• http://kb.cert.org/vuls/id/368132 · Note
• https://docs.microsoft.com/security-updates/securitybulletins/2007/MS07-013 · Note
• http://us-cert.gov/cas/techalerts/TA07-044A.html · Note
• http://securitytracker.com/id?1017641 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1090 · Note
• http://securitytracker.com/id?1017640 · Note