CVE-2006-2492
Last modified
CVE-2006-2492 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.. CISA has confirmed active exploitation in the wild. EPSS estimates a 48.39% chance of exploitation in the next 30 days.
Description
Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitation Status
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by .
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Microsoft | Office | 2000 | Sp3 |
| Microsoft | Office | 2003 | Sp1 |
| Microsoft | Office | xp | Sp3 |
| Microsoft | Works Suite | >= 2000, <= 2006 | — |
References
- http://secunia.com/advisories/20153Broken Link, Patch, Vendor Advisory
- http://securitytracker.com/id?1016130Broken Link, Third Party Advisory, VDB Entry
- http://www.kb.cert.org/vuls/id/446012Third Party Advisory, US Government Resource
- http://www.microsoft.com/technet/security/advisory/919637.mspxBroken Link, Patch, Vendor Advisory
- http://www.osvdb.org/25635Broken Link
- http://www.securityfocus.com/bid/18037Broken Link, Patch, Third Party Advisory, VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA06-139A.htmlBroken Link, Third Party Advisory, US Government Resource
- http://www.us-cert.gov/cas/techalerts/TA06-164A.htmlBroken Link, Third Party Advisory, US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-027Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26556Third Party Advisory, VDB Entry
- http://secunia.com/advisories/20153Broken Link, Patch, Vendor Advisory
- http://securitytracker.com/id?1016130Broken Link, Third Party Advisory, VDB Entry
- http://www.kb.cert.org/vuls/id/446012Third Party Advisory, US Government Resource
- http://www.microsoft.com/technet/security/advisory/919637.mspxBroken Link, Patch, Vendor Advisory
- http://www.osvdb.org/25635Broken Link
- http://www.securityfocus.com/bid/18037Broken Link, Patch, Third Party Advisory, VDB Entry
- http://www.us-cert.gov/cas/techalerts/TA06-139A.htmlBroken Link, Third Party Advisory, US Government Resource
- http://www.us-cert.gov/cas/techalerts/TA06-164A.htmlBroken Link, Third Party Advisory, US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-027Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26556Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2006-2492US Government Resource
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2006-2492?
How severe is CVE-2006-2492?
How do I fix CVE-2006-2492?
Are you affected by CVE-2006-2492?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST