vulnwire
4.3med

CVE-2006-52961 exploit

PowerPoint in Microsoft Office 2003 does not properly handle a container object whose position value exceeds the record length, which allow…

Published 20 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
27.0%
percentile 98%
Public exploits
1
Exploit-DB

PowerPoint in Microsoft Office 2003 does not properly handle a container object whose position value exceeds the record length, which allows user-assisted attackers to cause a denial of service (NULL dereference and application crash) via a crafted PowerPoint (.PPT) file, as demonstrated by Nanika.ppt, and a different vulnerability than CVE-2006-3435, CVE-2006-3876, CVE-2006-3877, and CVE-2006-4694. NOTE: the impact of this issue was originally claimed to be arbitrary code execution, but later analysis demonstrated that this was erroneous.

Exploit prediction (EPSS)

26.98% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • EDB-2523 Microsoft Office 2003 - '.PPT' Local Buffer Overflow (PoC) · dos · 2006-10-12

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:N/A:P

References

  • vupen.com /english/advisories/2006/4031 · vdb-entry, x_refsource_VUPEN, x_transferred
  • securitytracker.com /id?1017059 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • informationweek.com /management/showArticle.jhtml?articleID=193302553 · x_refsource_MISC, x_transferred
  • research.eeye.com /html/alerts/zeroday/20061012_2.html · x_refsource_MISC, x_transferred
  • osvdb.org /29720 · vdb-entry, x_refsource_OSVDB, x_transferred
  • secunia.com /advisories/22394 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • exploit-db.com /exploits/2523 · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • blogs.technet.com /msrc/archive/2006/11/10/follow-up-information-on-weblog-posting-about-poc-published-for-m · x_refsource_CONFIRM, x_transferred
  • blogs.technet.com /msrc/archive/2006/10/12/poc-published-for-ms-office-2003-powerpoint.aspx · x_refsource_MISC, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/29507 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/20495 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.