CVE-2006-3493 Memory corruption in n/a
Remote attackers can cause a denial of service in Microsoft Office via a crafted file, requiring user interaction to open the document.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2006-3493?
CVE-2006-3493 is a medium-severity memory corruption vulnerability in Microsoft Office, published on 10 Jul 2006. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Buffer overflow in LsCreateLine function (mso_203) in mso.dll and mso9.dll, as used by Microsoft Word and possibly other products in Microsoft Office 2003, 2002, and 2000, allows remote user-assisted attackers to cause a denial of service (crash) via a crafted Word DOC or other Office file type. NOTE: this issue was originally reported to allow code execution, but on 20060710 Microsoft stated that code execution is not possible, and the original researcher agrees.
Which versions are affected by CVE-2006-3493?
It affects 1 product.
Products include Microsoft Office.
How do I fix CVE-2006-3493?
No fix has been published for CVE-2006-3493 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2006-3493 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-3493 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Microsoft Office
Sources
Also known as GHSA-f8c7-wfvw-q6v3.