Microsoft · Word
CVE-2006-2492
Microsoft Word Malformed Object Pointer Vulnerability
Qué es
Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allows user-assisted attackers to execute arbitrary code via a malformed object pointer, as originally reported by ISC on 20060519 for a zero-day attack.
CISA: Microsoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 22 de junio de 2022
- Añadida a la lista de CISA
- 8 de junio de 2022
- Publicada
- 20 de mayo de 2006
- Gravedad
- Alto 8,8 CVSS 3.1
- Probabilidad de ataques en los próximos 30 días (EPSS)
- 48% entre el 1,1% superior de todas las vulnerabilidades conocidas
- Debilidad
- CWE-120
- Más detalles
- NVD · CVE.org · CISA
Todas las referencias (17)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-027
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2068
- http://isc.sans.org/diary.php?storyid=1345
- http://www.osvdb.org/25635
- http://www.microsoft.com/technet/security/advisory/919637.mspx
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1738
- http://isc.sans.org/diary.php?storyid=1346
- http://www.us-cert.gov/cas/techalerts/TA06-164A.html
- http://www.vupen.com/english/advisories/2006/1872
- http://www.securityfocus.com/bid/18037
- http://secunia.com/advisories/20153
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26556
- http://www.kb.cert.org/vuls/id/446012
- http://securitytracker.com/id?1016130
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1418
- http://www.us-cert.gov/cas/techalerts/TA06-139A.html
- http://blogs.technet.com/msrc/archive/2006/05/19/429353.aspx
Más fallos explotados de Microsoft
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 12 sept 2023 | Information Disclosure | Word | Media 6,5 | 20% |
| 28 mar 2022 | Remote Code Execution | Word | Alto 7,8 | 53% |
| 15 feb 2022 | Memory Corruption | Word | Alto 7,8 | 78% |
| 13 oct 2026 | Command Injection | Windows | Alto 8,8 | 9,8% |
| 25 sept 2026 | Code Injection | SharePoint | Alto 8,8 | 8,2% |
| 8 sept 2026 | Link Following | Windows | Alto 7,8 | 0,4% |
| 8 sept 2026 | Heap-Based Buffer Overflow | Windows | Alto 7,8 | 0,4% |
| 26 ago 2026 | Remote Code Execution | SQL Server | Alto 8,8 | 57% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.