CVE-2013-3848

Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3847, CVE-2013-3849, and CVE-2013-3858.

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.us-cert.gov/ncas/alerts/TA13-253A	Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-067
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-072
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18281
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18800

Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:office_web_apps:2010:sp1:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:a:microsoft:office_compatibility_pack::sp3::::::*
	cpe:2.3:a:microsoft:word:2003:sp3::::::
	cpe:2.3:a:microsoft:word:2007:sp3::::::
	cpe:2.3:a:microsoft:word:2010:sp1::::::
	cpe:2.3:a:microsoft:word_viewer::::::::

Configuration 3 (hide)

cpe:2.3:a:microsoft:sharepoint_server:2010:sp1:*:*:*:*:*:*

History

No history.

Information

Published : 2013-09-11 14:03

Updated : 2024-02-28 12:00

NVD link : CVE-2013-3848

Mitre link : CVE-2013-3848

CVE.ORG link : CVE-2013-3848

JSON object : View

Products Affected

microsoft

word
sharepoint_server
word_viewer
office_compatibility_pack
office_web_apps

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"id": "CVE-2013-3848", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2013-09-11T14:03:48.220", "references": [{"url": "http://www.us-cert.gov/ncas/alerts/TA13-253A", "tags": ["Third Party Advisory", "US Government Resource"], "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-067", "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-072", "source": "secure@microsoft.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18281", "source": "secure@microsoft.com"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18800", "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka \"Word Memory Corruption Vulnerability,\" a different vulnerability than CVE-2013-3847, CVE-2013-3849, and CVE-2013-3858."}, {"lang": "es", "value": "Microsoft Word Automation Services en SharePoint Server 2010 SP1, Word Web App 2010 SP1 en Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, y Word Viewer permiten a un atacante remoto ejecutar c\u00f3digo a discrecci\u00f3n o causar una denegaci\u00f3n de servicio (corrupci\u00f3n de memoria) a trav\u00e9s de un documento Office manipulado, tambien conocida como \"Vulnerbailidad de Corrupci\u00f3n de Memoria\", una vulnerabilidad diferente a CVE-2013-3847, CVE-2013-3849, and CVE-2013-3858."}], "lastModified": "2018-10-12T22:04:58.773", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office_web_apps:2010:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "343EEB54-C1B1-4D7B-8780-5B5A5F2F840C"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44BC7B7B-7191-431C-8CAE-83B3F0EFF03E"}, {"criteria": "cpe:2.3:a:microsoft:word:2003:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80F8E09E-E7F7-4D86-B140-3933EDC54E1C"}, {"criteria": "cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D006508-BFB0-4F21-A361-3DA644F51D8A"}, {"criteria": "cpe:2.3:a:microsoft:word:2010:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D2A0758C-6499-407F-823A-6F28BE56805E"}, {"criteria": "cpe:2.3:a:microsoft:word_viewer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D79B6572-E7DF-4CC2-B70B-9B31BE1B6A81"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:sharepoint_server:2010:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FA65D4A-00C8-47E2-AF9F-6B420017CD29"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}