Microsoft · Office
CVE-2010-3333
Microsoft Office Stack-based Buffer Overflow Vulnerability
무엇인가
Stack-based buffer overflow in Microsoft Office XP SP3, Office 2003 SP3, Office 2007 SP2, Office 2010, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via crafted RTF data, aka "RTF Stack Buffer Overflow Vulnerability."
CISA: A stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2022년 3월 24일
- CISA 목록에 추가됨
- 2022년 3월 3일
- 게시됨
- 2010년 11월 10일
- 심각도
- 높음 7.8 CVSS 3.1
- 향후 30일 내 공격 가능성(EPSS)
- 89% 알려진 모든 취약점 중 상위 0.2%
- 약점 유형
- CWE-119
- 자세히
- NVD · CVE.org · CISA
모든 참고 자료(10)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-087
- http://www.securitytracker.com/id?1024705
- http://securityreason.com/securityalert/8293
- http://secunia.com/advisories/42144
- http://secunia.com/advisories/38521
- http://www.vupen.com/english/advisories/2010/2923
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=880
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11931
- http://www.us-cert.gov/cas/techalerts/TA10-313A.html
- http://www.securityfocus.com/bid/44652
Microsoft의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 4. 14. | Remote Code Execution | Office | 높음 8.8 | 43% |
| 2026. 2. 10. | Word Reliance on Untrusted Inputs in a Security Decision | Office | 높음 7.8 | 1.6% |
| 2026. 1. 26. | Security Feature Bypass | Office | 높음 7.8 | 71% |
| 2026. 1. 7. | PowerPoint Code Injection | Office | 높음 8.8 | 67% |
| 2025. 8. 12. | Excel Remote Code Execution | Office | 높음 8.8 | 43% |
| 2023. 3. 14. | Outlook Privilege Escalation | Office | 치명적 9.8 | 97% |
| 2023. 2. 14. | Publisher Security Feature Bypass | Office | 높음 7.3 | 12% |
| 2022. 6. 8. | Object Record Corruption | Office | 높음 7.8 | 53% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.