Technical Description

Two vulnerabilities have been identified in Microsoft Office Excel, which could be exploited by attackers to compromise a vulnerable system.

This first issue is caused by a memory corruption error when processing a malformed Excel document, which could allow attackers to cause a vulnerable application to crash or execute arbitrary code by tricking a user into opening a specially crafted Excel file.

The second vulnerability is caused by an invalid object access. For additional information, see : VUPEN/ADV-2009-0514

Affected Products

Microsoft Office Excel 2000 Service Pack 3
Microsoft Office Excel 2002 Service Pack 3
Microsoft Office Excel 2003 Service Pack 3
Microsoft Office Excel 2007 Service Pack 1

Microsoft Office 2000 Service Pack 3
Microsoft Office XP Service Pack 3
Microsoft Office 2003 Service Pack 3
2007 Microsoft Office System Service Pack 1
Microsoft Office 2004 for Mac
Microsoft Office 2008 for Mac
Microsoft Office Excel Viewer 2003 Service Pack 3
Microsoft Office Excel Viewer
Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1

Solution

Apply patches :
http://www.microsoft.com/technet/security/Bulletin/MS09-009.mspx

References

http://www.vupen.com/english/advisories/2009/1023
http://www.microsoft.com/technet/security/Bulletin/MS09-009.mspx

Credits

Vulnerabilities reported by Haifei Li (Fortinet FortiGuard Global Security Research Team) and the vendor.

ChangeLog

2009-04-14 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts with CVE, CWE, and CVSS when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.