CVE-2014-2778

EPSS 40.4%
Veröffentlicht 11.06.2014 04:56:20
Zuletzt bearbeitet 12.04.2025 10:46:40
Quelle secure@microsoft.com
Teams Watchlist Login
Unerledigt Login

Microsoft Word 2007 SP3 and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted embedded font in a (1) .doc or (2) .docx document, aka "Embedded Font Vulnerability."

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 8

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Microsoft ≫ Office Compatibility Pack Updatesp3

Microsoft ≫ Word Version2007 Updatesp3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	40.4%	0.97

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.3	8.6	10	AV:N/AC:M/Au:N/C:C/I:C/A:C

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://blogs.technet.com/b/srd/archive/2014/06/10/assessing-risk-for-the-june-2014-security-updates.aspx

Vendor Advisory

http://secunia.com/advisories/58551

Permissions Required

http://www.securityfocus.com/bid/67896

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1030383

Third Party Advisory

VDB Entry

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-034

https://nvd.nist.gov/vuln/detail/CVE-2014-2778

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-2778

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-2778

EUVD