Overview
Microsoft Word fails to properly parse rich text content and may allow a remote, unauthenticated attacker to execute arbitrary code.
Description
Microsoft Word does not properly validate rich text within the contents of a file. When Word opens and parses a specially crafted file, memory corruption can occur and can allow arbitrary code execution. By convincing a user to open a specially crafted Word file, an attacker may be able to execute arbitrary code. |
Impact
A remote, unauthenticated attacker may be able to execute arbitrary code or access the system with the privileges of the local user. |
Solution
Apply an Update Microsoft has released updates in Microsoft Security Bulletin MS07-024 to address this issue. |
Workaround
|
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | ||
| Temporal | ||
| Environmental |
References
Acknowledgements
This vulnerability was reported in Microsoft Security Bulletin MS07-024. Microsoft thanks iDefense Labs for reporting the vulnerability to them.
This document was written by Katie Steiner.
Other Information
| CVE IDs: | CVE-2007-1202 |
| Severity Metric: | 3.44 |
| Date Public: | 2007-05-08 |
| Date First Published: | 2007-05-09 |
| Date Last Updated: | 2007-05-09 20:27 UTC |
| Document Revision: | 10 |