CVE-2013-3847

Microsoft Word Automation Services in SharePoint Server 2010 SP1 - Remote Code Execution via Crafted Office Document

Title source: llm
STIX 2.1

Description

Microsoft Word Automation Services in SharePoint Server 2010 SP1, Word Web App 2010 SP1 in Office Web Apps 2010, Word 2003 SP3, Word 2007 SP3, Word 2010 SP1, Office Compatibility Pack SP3, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Word Memory Corruption Vulnerability," a different vulnerability than CVE-2013-3848, CVE-2013-3849, and CVE-2013-3858.

References (5)

Core 5
Core References
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18749
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18988
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert
http://www.us-cert.gov/ncas/alerts/TA13-253A

Scores

EPSS 0.2097
EPSS Percentile 97.3%

Details

CWE
CWE-119
Status published
Products (11)
microsoft/office_compatibility_pack
microsoft/office_web_apps 2010 sp1
microsoft/sharepoint_foundation 2010 sp1 (2 CPE variants)
microsoft/sharepoint_portal_server 2003 sp3
microsoft/sharepoint_server 2010 sp1 (2 CPE variants)
microsoft/sharepoint_services 2.0
microsoft/sharepoint_services 3.0
microsoft/word 2003 sp3
microsoft/word 2007 sp3
microsoft/word 2010 sp1
... and 1 more
Published Sep 11, 2013
Tracked Since Feb 18, 2026