CVE-2008-0119

Microsoft Office Publisher Remote Code Execution via Crafted Object Header Data

Title source: llm
STIX 2.1

Description

Unspecified vulnerability in Microsoft Publisher in Office 2000 and XP SP3, 2003 SP2 and SP3, and 2007 SP1 and earlier allows remote attackers to execute arbitrary code via a Publisher file with crafted object header data that triggers memory corruption, aka "Publisher Object Handler Validation Vulnerability."

References (9)

Core 9
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1020015
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/1505/references
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/30150
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=121129490723574&w=2
US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/cas/techalerts/TA08-134A.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/29158
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/492073/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5303

Scores

EPSS 0.3099
EPSS Percentile 98.0%

Details

CWE
CWE-94
Status published
Products (5)
microsoft/office 2000 sp3
microsoft/office 2003 sp2 (2 CPE variants)
microsoft/office 2007
microsoft/office 2007_sp1
microsoft/office xp sp3
Published May 13, 2008
Tracked Since Feb 18, 2026