CVE-2008-4024

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-12-09T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Microsoft Office Word 2000 SP3 and 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a Word document with a crafted lcbPlcfBkfSdt field in the File Information Block (FIB), which bypasses an initialization step and triggers an \"arbitrary free,\" aka \"Word Memory Corruption Vulnerability.\""}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-12T19:57:01.000Z", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft"}, "references": [{"name": "MS08-072", "tags": ["vendor-advisory", "x_refsource_MS"], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-072"}, {"name": "20081210 CORE-2008-0228: Microsoft Word Malformed FIB Arbitrary Free Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/499086/100/0/threaded"}, {"name": "oval:org.mitre.oval:def:5934", "tags": ["vdb-entry", "signature", "x_refsource_OVAL"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5934"}, {"tags": ["x_refsource_MISC"], "url": "http://www.coresecurity.com/files/attachments/CORE-2008-0228-Word.pdf"}, {"name": "1021370", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1021370"}, {"name": "TA08-344A", "tags": ["third-party-advisory", "x_refsource_CERT"], "url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html"}, {"name": "ADV-2008-3384", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2008/3384"}, {"tags": ["x_refsource_MISC"], "url": "http://www.coresecurity.com/content/word-arbitrary-free"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@microsoft.com", "ID": "CVE-2008-4024", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Microsoft Office Word 2000 SP3 and 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a Word document with a crafted lcbPlcfBkfSdt field in the File Information Block (FIB), which bypasses an initialization step and triggers an \"arbitrary free,\" aka \"Word Memory Corruption Vulnerability.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "MS08-072", "refsource": "MS", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-072"}, {"name": "20081210 CORE-2008-0228: Microsoft Word Malformed FIB Arbitrary Free Vulnerability", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/499086/100/0/threaded"}, {"name": "oval:org.mitre.oval:def:5934", "refsource": "OVAL", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5934"}, {"name": "http://www.coresecurity.com/files/attachments/CORE-2008-0228-Word.pdf", "refsource": "MISC", "url": "http://www.coresecurity.com/files/attachments/CORE-2008-0228-Word.pdf"}, {"name": "1021370", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1021370"}, {"name": "TA08-344A", "refsource": "CERT", "url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html"}, {"name": "ADV-2008-3384", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2008/3384"}, {"name": "http://www.coresecurity.com/content/word-arbitrary-free", "refsource": "MISC", "url": "http://www.coresecurity.com/content/word-arbitrary-free"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T10:00:42.258Z"}, "title": "CVE Program Container", "references": [{"name": "MS08-072", "tags": ["vendor-advisory", "x_refsource_MS", "x_transferred"], "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-072"}, {"name": "20081210 CORE-2008-0228: Microsoft Word Malformed FIB Arbitrary Free Vulnerability", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/499086/100/0/threaded"}, {"name": "oval:org.mitre.oval:def:5934", "tags": ["vdb-entry", "signature", "x_refsource_OVAL", "x_transferred"], "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5934"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.coresecurity.com/files/attachments/CORE-2008-0228-Word.pdf"}, {"name": "1021370", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1021370"}, {"name": "TA08-344A", "tags": ["third-party-advisory", "x_refsource_CERT", "x_transferred"], "url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html"}, {"name": "ADV-2008-3384", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2008/3384"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.coresecurity.com/content/word-arbitrary-free"}]}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2008-4024", "datePublished": "2008-12-10T13:33:00.000Z", "dateReserved": "2008-09-10T00:00:00.000Z", "dateUpdated": "2024-08-07T10:00:42.258Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "secure@microsoft.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*", "matchCriteriaId": "9409A9BD-1E9B-49B8-884F-8FE569D8AA25", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2008:*:mac:*:*:*:*:*", "matchCriteriaId": "5BA91840-371C-4282-9F7F-B393F785D260", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:*:*:*:*:*:*:*", "matchCriteriaId": "CD97FF64-64A5-467C-B352-45B89B4A6536", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_compatibility_pack_for_word_excel_ppt_2007:*:sp1:*:*:*:*:*:*", "matchCriteriaId": "34C5FEAD-4B4B-44EB-9F3A-05093347A2F1", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_word_viewer:2003:*:*:*:*:*:*:*", "matchCriteriaId": "523CCEC6-6B7D-4D77-B2B0-4E4C349A7030", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_word_viewer:2003:sp3:*:*:*:*:*:*", "matchCriteriaId": "B4B148CC-6C58-411B-8503-01F3BE1D5906", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:open_xml_file_format_converter:*:*:mac:*:*:*:*:*", "matchCriteriaId": "3807A4E4-EB58-47B6-AD98-6ED464DEBA4E", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:works:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "293914AF-6101-4F50-9560-A4EA99D767C4", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office_outlook:2007:*:*:*:*:*:*:*", "matchCriteriaId": "29AB63E7-7FB6-47DE-9451-676887AFC55C", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_outlook:2007:sp1:*:*:*:*:*:*", "matchCriteriaId": "45E63CC9-6EBC-4672-A0DB-A73D455002C1", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_word:2000:sp3:*:*:*:*:*:*", "matchCriteriaId": "C1B2B207-751F-4596-B805-B4622E312B93", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_word:2002:sp3:*:*:*:*:*:*", "matchCriteriaId": "0E99B12F-0DB7-4D0F-AD54-DD906CC8E3BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_word:2003:sp3:*:*:*:*:*:*", "matchCriteriaId": "CDA5243A-BA58-41BC-8FFC-317239E511C2", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_word:2007:*:*:*:*:*:*:*", "matchCriteriaId": "CF8D06FE-002B-48B2-991D-860C3AF7D2D1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*", "matchCriteriaId": "4891122F-AD7F-45E6-98C6-833227916F6B", "vulnerable": false}, {"criteria": "cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*", "matchCriteriaId": "A332D04D-CC8C-4F68-A261-BA2F2D8EAD1E", "vulnerable": false}, {"criteria": "cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*", "matchCriteriaId": "79BA1175-7F02-4435-AEA6-1BA8AADEB7EF", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:office_system:*:2007:*:*:*:*:*:*", "matchCriteriaId": "224A6712-E6DF-4BC6-9D61-73DD73C2F66B", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:office_system:sp1:2007:*:*:*:*:*:*", "matchCriteriaId": "491B00D2-3B9B-46AB-B068-B1AD96698EE2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Microsoft Office Word 2000 SP3 and 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a Word document with a crafted lcbPlcfBkfSdt field in the File Information Block (FIB), which bypasses an initialization step and triggers an \"arbitrary free,\" aka \"Word Memory Corruption Vulnerability.\""}, {"lang": "es", "value": "Microsoft Office Word 2000 SP3 y 2002 SP3 y Office 2004 para Mac permiten a los atacantes remotos ejecutar c\u00f3digo arbitrario por medio de un documento de Word con un campo lcbPlcfBkfSdt creado en el Bloque de Informaci\u00f3n de Archivos (FIB), que omite un paso de inicializaci\u00f3n y activa un \"arbitrary free,\" aka \"Word Memory Corruption Vulnerability.\""}], "id": "CVE-2008-4024", "lastModified": "2026-06-16T22:57:00.750", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2008-12-10T14:00:00.783", "references": [{"source": "secure@microsoft.com", "url": "http://www.coresecurity.com/content/word-arbitrary-free"}, {"source": "secure@microsoft.com", "url": "http://www.coresecurity.com/files/attachments/CORE-2008-0228-Word.pdf"}, {"source": "secure@microsoft.com", "url": "http://www.securityfocus.com/archive/1/499086/100/0/threaded"}, {"source": "secure@microsoft.com", "url": "http://www.securitytracker.com/id?1021370"}, {"source": "secure@microsoft.com", "tags": ["US Government Resource"], "url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html"}, {"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2008/3384"}, {"source": "secure@microsoft.com", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-072"}, {"source": "secure@microsoft.com", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5934"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.coresecurity.com/content/word-arbitrary-free"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.coresecurity.com/files/attachments/CORE-2008-0228-Word.pdf"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/499086/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1021370"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["US Government Resource"], "url": "http://www.us-cert.gov/cas/techalerts/TA08-344A.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.vupen.com/english/advisories/2008/3384"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-072"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5934"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}