CVE-2006-3650

CRITICAL 9.3CVE-2006-3650 · Published 10/10/2006 · updated 16/06/2026

Package	Affected versions	Patched versions
office microsoft	`= 2000= 2001= 2003= 2004= v.x`	No fix yet

Description

Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac do not properly parse the length of a chart record, which allows remote user-assisted attackers to execute arbitrary code via a Word document with an embedded malformed chart record that triggers an overwrite of pointer values with values from the document, a different vulnerability than CVE-2006-3434, CVE-2006-3864, and CVE-2006-3868.

References

secunia.com/advisories/22339 · Vendor Advisory
securitytracker.com/id · Third Party Advisory
kb.cert.org/vuls/id/534276 · Third Party Advisory
osvdb.org/29428 · Broken Link
securityfocus.com/archive/1/448151/100/0/threaded
securityfocus.com/archive/1/449179/100/0/threaded
securityfocus.com/bid/20383 · Third Party Advisory
vupen.com/english/advisories/2006/3981 · Vendor Advisory
zerodayinitiative.com/advisories/ZDI-06-034.html · Third Party Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-062
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A222 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free