Vulnerability-Lookup

CVE-2006-5994 (GCVE-0-2006-5994)

Vulnerability from cvelistv5 – Published: 2006-12-06 20:00 – Updated: 2024-08-07 20:12

Summary

Unspecified vulnerability in Microsoft Word 2000 and 2002, Office Word and Word Viewer 2003, Word 2004 and 2004 v. X for Mac, and Works 2004, 2005, and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption, a different vulnerability than CVE-2006-6456.

Severity

No CVSS data available.

CWE

Assigner

microsoft CNA under the mitre root

CNA scorecard B 82/100 over 3957 records in the last 180 days details

References

17 references

URL	Tags
http://www.osvdb.org/30824	vdb-entryx_refsource_OSVDB
http://www.securityfocus.com/archive/1/453735/100…	mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/archive/1/453906/100…	mailing-listx_refsource_BUGTRAQ
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
http://www.microsoft.com/technet/security/advisor…	x_refsource_CONFIRM
http://secunia.com/advisories/23232	third-party-advisoryx_refsource_SECUNIA
http://www.us-cert.gov/cas/techalerts/TA07-044A.html	third-party-advisoryx_refsource_CERT
http://blogs.technet.com/msrc/archive/2006/12/06/…	x_refsource_CONFIRM
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://blogs.securiteam.com/?p=759	x_refsource_MISC
http://www.vupen.com/english/advisories/2006/4866	vdb-entryx_refsource_VUPEN
https://docs.microsoft.com/en-us/security-updates…	vendor-advisoryx_refsource_MS
http://www.kb.cert.org/vuls/id/167928	third-party-advisoryx_refsource_CERT-VN
http://securitytracker.com/id?1017339	vdb-entryx_refsource_SECTRACK
http://www.computerworld.com/action/article.do?co…	x_refsource_MISC
http://www.securityfocus.com/bid/21451	vdb-entryx_refsource_BID
http://www.securityfocus.com/archive/1/454061/100…	mailing-listx_refsource_BUGTRAQ

Date Public

2006-12-05 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T20:12:31.324Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "30824",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/30824"
          },
          {
            "name": "20061206 Microsoft 0-day word vulnerability - Secunia - Extremely critical",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/453735/100/0/threaded"
          },
          {
            "name": "20061208 Microsoft Word 0-day Vulnerability FAQ (CVE-2006-5994) written",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/453906/100/0/threaded"
          },
          {
            "name": "word-unspecified-code-execution(30738)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30738"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.microsoft.com/technet/security/advisory/929433.mspx"
          },
          {
            "name": "23232",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/23232"
          },
          {
            "name": "TA07-044A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA07-044A.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx"
          },
          {
            "name": "oval:org.mitre.oval:def:238",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A238"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blogs.securiteam.com/?p=759"
          },
          {
            "name": "ADV-2006-4866",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/4866"
          },
          {
            "name": "MS07-014",
            "tags": [
              "vendor-advisory",
              "x_refsource_MS",
              "x_transferred"
            ],
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014"
          },
          {
            "name": "VU#167928",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/167928"
          },
          {
            "name": "1017339",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1017339"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.computerworld.com/action/article.do?command=viewArticleBasic\u0026articleId=9005698\u0026intsrc=hm_list"
          },
          {
            "name": "21451",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/21451"
          },
          {
            "name": "20061210 Several updates in Microsoft Word 0-day (CVE-2006-5994) FAQ document",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/454061/100/0/threaded"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-12-05T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in Microsoft Word 2000 and 2002, Office Word and Word Viewer 2003, Word 2004 and 2004 v. X for Mac, and Works 2004, 2005, and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption, a different vulnerability than CVE-2006-6456."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-17T20:57:01.000Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "30824",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/30824"
        },
        {
          "name": "20061206 Microsoft 0-day word vulnerability - Secunia - Extremely critical",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/453735/100/0/threaded"
        },
        {
          "name": "20061208 Microsoft Word 0-day Vulnerability FAQ (CVE-2006-5994) written",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/453906/100/0/threaded"
        },
        {
          "name": "word-unspecified-code-execution(30738)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30738"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.microsoft.com/technet/security/advisory/929433.mspx"
        },
        {
          "name": "23232",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/23232"
        },
        {
          "name": "TA07-044A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA07-044A.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx"
        },
        {
          "name": "oval:org.mitre.oval:def:238",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A238"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blogs.securiteam.com/?p=759"
        },
        {
          "name": "ADV-2006-4866",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/4866"
        },
        {
          "name": "MS07-014",
          "tags": [
            "vendor-advisory",
            "x_refsource_MS"
          ],
          "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014"
        },
        {
          "name": "VU#167928",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/167928"
        },
        {
          "name": "1017339",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1017339"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.computerworld.com/action/article.do?command=viewArticleBasic\u0026articleId=9005698\u0026intsrc=hm_list"
        },
        {
          "name": "21451",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/21451"
        },
        {
          "name": "20061210 Several updates in Microsoft Word 0-day (CVE-2006-5994) FAQ document",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/454061/100/0/threaded"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2006-5994",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in Microsoft Word 2000 and 2002, Office Word and Word Viewer 2003, Word 2004 and 2004 v. X for Mac, and Works 2004, 2005, and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption, a different vulnerability than CVE-2006-6456."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "30824",
              "refsource": "OSVDB",
              "url": "http://www.osvdb.org/30824"
            },
            {
              "name": "20061206 Microsoft 0-day word vulnerability - Secunia - Extremely critical",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/453735/100/0/threaded"
            },
            {
              "name": "20061208 Microsoft Word 0-day Vulnerability FAQ (CVE-2006-5994) written",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/453906/100/0/threaded"
            },
            {
              "name": "word-unspecified-code-execution(30738)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30738"
            },
            {
              "name": "http://www.microsoft.com/technet/security/advisory/929433.mspx",
              "refsource": "CONFIRM",
              "url": "http://www.microsoft.com/technet/security/advisory/929433.mspx"
            },
            {
              "name": "23232",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/23232"
            },
            {
              "name": "TA07-044A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA07-044A.html"
            },
            {
              "name": "http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx",
              "refsource": "CONFIRM",
              "url": "http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx"
            },
            {
              "name": "oval:org.mitre.oval:def:238",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A238"
            },
            {
              "name": "http://blogs.securiteam.com/?p=759",
              "refsource": "MISC",
              "url": "http://blogs.securiteam.com/?p=759"
            },
            {
              "name": "ADV-2006-4866",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/4866"
            },
            {
              "name": "MS07-014",
              "refsource": "MS",
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014"
            },
            {
              "name": "VU#167928",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/167928"
            },
            {
              "name": "1017339",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1017339"
            },
            {
              "name": "http://www.computerworld.com/action/article.do?command=viewArticleBasic\u0026articleId=9005698\u0026intsrc=hm_list",
              "refsource": "MISC",
              "url": "http://www.computerworld.com/action/article.do?command=viewArticleBasic\u0026articleId=9005698\u0026intsrc=hm_list"
            },
            {
              "name": "21451",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/21451"
            },
            {
              "name": "20061210 Several updates in Microsoft Word 0-day (CVE-2006-5994) FAQ document",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/454061/100/0/threaded"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2006-5994",
    "datePublished": "2006-12-06T20:00:00.000Z",
    "dateReserved": "2006-11-21T00:00:00.000Z",
    "dateUpdated": "2024-08-07T20:12:31.324Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2006-5994",
      "date": "2026-10-27",
      "epss": "0.32013",
      "percentile": "0.98301"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*",
                    "matchCriteriaId": "4891122F-AD7F-45E6-98C6-833227916F6B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:office:2003:sp2:*:*:*:*:*:*",
                    "matchCriteriaId": "07D3F3E4-93FB-481A-94D9-075E726697C4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*",
                    "matchCriteriaId": "9409A9BD-1E9B-49B8-884F-8FE569D8AA25",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*",
                    "matchCriteriaId": "79BA1175-7F02-4435-AEA6-1BA8AADEB7EF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:word:2000:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AEBFF713-0884-43BF-9AB8-777664FD64AF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:word:2002:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2D90B1E1-23CD-4595-AD78-DA1758E9896D",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:word:2003:*:*:*:*:*:*:*",
                    "matchCriteriaId": "379C2A4A-78EF-473D-954B-F5DD76C3D6CF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:word_viewer:2003:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1889A686-9565-4958-99BB-2EC24ABDF272",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:works:2004:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F98B6FDD-E9AA-49A4-8D9C-422DF5520A66",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:works:2005:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CB8E7A05-97EE-40A4-A410-B2DE582AA381",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:microsoft:works:2006:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8C180D46-EEFE-416B-AB4D-A7EF0B749105",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Unspecified vulnerability in Microsoft Word 2000 and 2002, Office Word and Word Viewer 2003, Word 2004 and 2004 v. X for Mac, and Works 2004, 2005, and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption, a different vulnerability than CVE-2006-6456."
          },
          {
            "lang": "es",
            "value": "Vulnerabilidad no especificada en Microsoft Word 2000 y 2002, Office Word y Word Viewer 2003, Word 2004 y 2004 v. X para Mac, y Works 2004, 2005, y 2006 permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n mediante un documento Word con una cadena mal formada que provoca una corrupci\u00f3n de memoria, una vulnerabilidad diferente que CVE-2006-6456."
          }
        ],
        "id": "CVE-2006-5994",
        "lastModified": "2026-04-23T00:35:47.467",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "COMPLETE",
                "baseScore": 9.3,
                "confidentialityImpact": "COMPLETE",
                "integrityImpact": "COMPLETE",
                "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 10.0,
              "obtainAllPrivilege": true,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ]
        },
        "published": "2006-12-06T20:28:00.000",
        "references": [
          {
            "source": "secure@microsoft.com",
            "url": "http://blogs.securiteam.com/?p=759"
          },
          {
            "source": "secure@microsoft.com",
            "url": "http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx"
          },
          {
            "source": "secure@microsoft.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/23232"
          },
          {
            "source": "secure@microsoft.com",
            "url": "http://securitytracker.com/id?1017339"
          },
          {
            "source": "secure@microsoft.com",
            "url": "http://www.computerworld.com/action/article.do?command=viewArticleBasic\u0026articleId=9005698\u0026intsrc=hm_list"
          },
          {
            "source": "secure@microsoft.com",
            "tags": [
              "US Government Resource"
            ],
            "url": "http://www.kb.cert.org/vuls/id/167928"
          },
          {
            "source": "secure@microsoft.com",
            "url": "http://www.microsoft.com/technet/security/advisory/929433.mspx"
          },
          {
            "source": "secure@microsoft.com",
            "url": "http://www.osvdb.org/30824"
          },
          {
            "source": "secure@microsoft.com",
            "url": "http://www.securityfocus.com/archive/1/453735/100/0/threaded"
          },
          {
            "source": "secure@microsoft.com",
            "url": "http://www.securityfocus.com/archive/1/453906/100/0/threaded"
          },
          {
            "source": "secure@microsoft.com",
            "url": "http://www.securityfocus.com/archive/1/454061/100/0/threaded"
          },
          {
            "source": "secure@microsoft.com",
            "url": "http://www.securityfocus.com/bid/21451"
          },
          {
            "source": "secure@microsoft.com",
            "tags": [
              "US Government Resource"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA07-044A.html"
          },
          {
            "source": "secure@microsoft.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/4866"
          },
          {
            "source": "secure@microsoft.com",
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014"
          },
          {
            "source": "secure@microsoft.com",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30738"
          },
          {
            "source": "secure@microsoft.com",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A238"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://blogs.securiteam.com/?p=759"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://secunia.com/advisories/23232"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://securitytracker.com/id?1017339"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.computerworld.com/action/article.do?command=viewArticleBasic\u0026articleId=9005698\u0026intsrc=hm_list"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "US Government Resource"
            ],
            "url": "http://www.kb.cert.org/vuls/id/167928"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.microsoft.com/technet/security/advisory/929433.mspx"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.osvdb.org/30824"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/453735/100/0/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/453906/100/0/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/archive/1/454061/100/0/threaded"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/21451"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "US Government Resource"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA07-044A.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/4866"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30738"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A238"
          }
        ],
        "sourceIdentifier": "secure@microsoft.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

CERTA-2006-ALE-014

Vulnerability from certfr_alerte - Published: 2006-12-06 - Updated: 2007-02-14

Des vulnérabilités liées aux documents de format Word permettent l'exécution de code arbitraire à distance.

Description

4.1 Alerte du 18 décembre 2006

Trois vulnérabilités ont été découvertes dans Microsoft Word et affectent également OpenOffice. Un utilisateur malintentionné peut, en incitant sa victime à ouvrir un document au format Word (par exemple par l'intermédiaire d'un message électronique ou d'un site web), provoquer l'exécution de code arbitraire à distance avec les privilèges de l'utilisateur.

Deux codes malveillants exploitent actuellement ces vulnérabilités et sont détectés par certains antivirus (à jour) sous les noms : Troj/DwnLdr-FXG, Troj/DwnLdr-FXH, TROJ_TINY_DU, Trojan_Downloader.Win32.Cryptic.ec, Trojan_Downloader.Win32.Cryptic.f, etc.

Il n'existe pas de correctif officiel pour le moment.

4.2 Mise à jour du 26 janvier 2007

Le 26 janvier 2007, Symantec fait état d'un code malveillant exploitant une nouvelle vulnérabilité non corrigée présente dans Microsoft Word 2000 (cf. section Documentation). Ce code malveillant circule sur Internet sous forme de document Word. Il est identifié par Symantec sous le nom : Trojan.Mdropper.W.

Comme les précédente vulnérabilités, il n'existe à ce jour pas de correctif officiel.

Contournement provisoire

5.1 Utiliser un format de document alternatif

Le CERTA recommande l'utilisation d'un format de document alternatif tel que le RTF.

5.2 Utiliser un logiciel alternatif

Le CERTA recommande d'utiliser un outil de visualisation des documents au format Word alternatif à jour (WordPad ou AbiWord).

5.3 Mettre à jour la base de signatures d'antivirus

Certains éditeurs d'antivirus proposent déjà des mises à jours de signatures prenant en compte les codes malveillants sous sa forme actuelle. Il est cependant probable que des variantes apparaissent afin de contourner ces antivirus.

5.4 Filtrer les pièces jointes au niveau des passerelles

Dans la mesure du possible, il est recommandé de filtrer les fichiers au format Word (extension .doc) au niveau des passerelles (messagerie, web ...).

5.5 N'ouvrir que les documents provenant de sources de confiance

A la reception d'un document au format doc soit par le biais de la messagerie électronique ou sur tout autre support, il est nécessaire de s'assurer de la provenance de ce fichier et de ne l'ouvrir que si la source est de confiance et après analyse par un antivirus à jour.

5.6 Limiter l'impact en utilisant un compte utilisateur sans privilège

L'utilisation de compte n'ayant pas de droits d'administration permet de limiter l'infection au contexte de l'utilisateur.

Solution

Appliquer les mises à jours de l'éditeur (cf. Documentation);

Microsoft Word 2000 ;
Microsoft Word 2002 ;
Microsoft Word 2003 ;
Microsoft Word Viewer 2003 ;
Microsoft Word 2004 pour Mac ;
Microsoft Word 2004 v. X pour Mac ;
Microsoft Works 2004, 2005 et 2006 ;
OpenOffice versions 2.x et antérieurs.

D'autres applications pourraient être affectées par ces vulnérabilités.

Impacted products

	Vendor	Product	Description

References

Title

Publication Time

CERTA-2007-AVI-083

Vulnerability from certfr_avis - Published: 2007-02-14 - Updated: 2007-02-14

De multiples vulnérabilités touchent les suites bureautique de Microsoft. L'exploitation de ces vulnérabilités peut conduire à l'exécution de code arbitraire à distance.

Description

De nombreuses vulnérabilités, dont certaines ayant déjà fait l'objet d'une alerte du CERTA (CERTA-2006-ALE-014, CERTA-2007-ALE-004), touchent les produits bureautiques de Microsoft. L'exploitation de ces vulnérabilités peut être conduit depuis le système vulnérable et/ou à distance, et permet l'exéction de code arbitraire. Cette exécution de code peut conduire à l'obtention du contrôle total de la machine vulnérable.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Microsoft	Office	Microsoft Visio 2002.
Microsoft	Office	Toutes versions de la suite Microsoft Office, à l'exception de Microsoft Office 2007 ;
Microsoft	Office	Microsoft Project versions 2000 et 2002 ;
Microsoft	Office	Microsoft Works Suite versions 2004, 2005 et 2006 ;

References

Title

Publication Time

FKIE_CVE-2006-5994

Vulnerability from fkie_nvd - Published: 2006-12-06 20:28 - Updated: 2026-06-16 22:32

Severity

Summary

References

URL	Tags
secure@microsoft.com	http://blogs.securiteam.com/?p=759
secure@microsoft.com	http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx
secure@microsoft.com	http://secunia.com/advisories/23232	Vendor Advisory
secure@microsoft.com	http://securitytracker.com/id?1017339
secure@microsoft.com	http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9005698&intsrc=hm_list
secure@microsoft.com	http://www.kb.cert.org/vuls/id/167928	US Government Resource
secure@microsoft.com	http://www.microsoft.com/technet/security/advisory/929433.mspx
secure@microsoft.com	http://www.osvdb.org/30824
secure@microsoft.com	http://www.securityfocus.com/archive/1/453735/100/0/threaded
secure@microsoft.com	http://www.securityfocus.com/archive/1/453906/100/0/threaded
secure@microsoft.com	http://www.securityfocus.com/archive/1/454061/100/0/threaded
secure@microsoft.com	http://www.securityfocus.com/bid/21451
secure@microsoft.com	http://www.us-cert.gov/cas/techalerts/TA07-044A.html	US Government Resource
secure@microsoft.com	http://www.vupen.com/english/advisories/2006/4866	Vendor Advisory
secure@microsoft.com	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014
secure@microsoft.com	https://exchange.xforce.ibmcloud.com/vulnerabilities/30738
secure@microsoft.com	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A238
af854a3a-2127-422b-91ae-364da2661108	http://blogs.securiteam.com/?p=759
af854a3a-2127-422b-91ae-364da2661108	http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx
af854a3a-2127-422b-91ae-364da2661108	http://secunia.com/advisories/23232	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://securitytracker.com/id?1017339
af854a3a-2127-422b-91ae-364da2661108	http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9005698&intsrc=hm_list
af854a3a-2127-422b-91ae-364da2661108	http://www.kb.cert.org/vuls/id/167928	US Government Resource
af854a3a-2127-422b-91ae-364da2661108	http://www.microsoft.com/technet/security/advisory/929433.mspx
af854a3a-2127-422b-91ae-364da2661108	http://www.osvdb.org/30824
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/453735/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/453906/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/archive/1/454061/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/21451
af854a3a-2127-422b-91ae-364da2661108	http://www.us-cert.gov/cas/techalerts/TA07-044A.html	US Government Resource
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2006/4866	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014
af854a3a-2127-422b-91ae-364da2661108	https://exchange.xforce.ibmcloud.com/vulnerabilities/30738
af854a3a-2127-422b-91ae-364da2661108	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A238

Impacted products

Vendor	Product	Version
microsoft	office	2000
microsoft	office	2003
microsoft	office	2004
microsoft	office	xp
microsoft	word	2000
microsoft	word	2002
microsoft	word	2003
microsoft	word_viewer	2003
microsoft	works	2004
microsoft	works	2005
microsoft	works	2006

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secure@microsoft.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*",
              "matchCriteriaId": "4891122F-AD7F-45E6-98C6-833227916F6B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2003:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "07D3F3E4-93FB-481A-94D9-075E726697C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*",
              "matchCriteriaId": "9409A9BD-1E9B-49B8-884F-8FE569D8AA25",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*",
              "matchCriteriaId": "79BA1175-7F02-4435-AEA6-1BA8AADEB7EF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:word:2000:*:*:*:*:*:*:*",
              "matchCriteriaId": "AEBFF713-0884-43BF-9AB8-777664FD64AF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:word:2002:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D90B1E1-23CD-4595-AD78-DA1758E9896D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:word:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "379C2A4A-78EF-473D-954B-F5DD76C3D6CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:word_viewer:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "1889A686-9565-4958-99BB-2EC24ABDF272",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:works:2004:*:*:*:*:*:*:*",
              "matchCriteriaId": "F98B6FDD-E9AA-49A4-8D9C-422DF5520A66",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:works:2005:*:*:*:*:*:*:*",
              "matchCriteriaId": "CB8E7A05-97EE-40A4-A410-B2DE582AA381",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:works:2006:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C180D46-EEFE-416B-AB4D-A7EF0B749105",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unspecified vulnerability in Microsoft Word 2000 and 2002, Office Word and Word Viewer 2003, Word 2004 and 2004 v. X for Mac, and Works 2004, 2005, and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption, a different vulnerability than CVE-2006-6456."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad no especificada en Microsoft Word 2000 y 2002, Office Word y Word Viewer 2003, Word 2004 y 2004 v. X para Mac, y Works 2004, 2005, y 2006 permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n mediante un documento Word con una cadena mal formada que provoca una corrupci\u00f3n de memoria, una vulnerabilidad diferente que CVE-2006-6456."
    }
  ],
  "id": "CVE-2006-5994",
  "lastModified": "2026-06-16T22:32:16.447",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2006-12-06T20:28:00.000",
  "references": [
    {
      "source": "secure@microsoft.com",
      "url": "http://blogs.securiteam.com/?p=759"
    },
    {
      "source": "secure@microsoft.com",
      "url": "http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx"
    },
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/23232"
    },
    {
      "source": "secure@microsoft.com",
      "url": "http://securitytracker.com/id?1017339"
    },
    {
      "source": "secure@microsoft.com",
      "url": "http://www.computerworld.com/action/article.do?command=viewArticleBasic\u0026articleId=9005698\u0026intsrc=hm_list"
    },
    {
      "source": "secure@microsoft.com",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/167928"
    },
    {
      "source": "secure@microsoft.com",
      "url": "http://www.microsoft.com/technet/security/advisory/929433.mspx"
    },
    {
      "source": "secure@microsoft.com",
      "url": "http://www.osvdb.org/30824"
    },
    {
      "source": "secure@microsoft.com",
      "url": "http://www.securityfocus.com/archive/1/453735/100/0/threaded"
    },
    {
      "source": "secure@microsoft.com",
      "url": "http://www.securityfocus.com/archive/1/453906/100/0/threaded"
    },
    {
      "source": "secure@microsoft.com",
      "url": "http://www.securityfocus.com/archive/1/454061/100/0/threaded"
    },
    {
      "source": "secure@microsoft.com",
      "url": "http://www.securityfocus.com/bid/21451"
    },
    {
      "source": "secure@microsoft.com",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA07-044A.html"
    },
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2006/4866"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30738"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A238"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://blogs.securiteam.com/?p=759"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/23232"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securitytracker.com/id?1017339"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.computerworld.com/action/article.do?command=viewArticleBasic\u0026articleId=9005698\u0026intsrc=hm_list"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/167928"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.microsoft.com/technet/security/advisory/929433.mspx"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/30824"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/453735/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/453906/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/454061/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/21451"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.us-cert.gov/cas/techalerts/TA07-044A.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2006/4866"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30738"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A238"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-P3MJ-FQ4C-FFQJ

Vulnerability from github – Published: 2022-05-01 07:33 – Updated: 2022-05-01 07:33

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2006-5994"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-12-06T20:28:00Z",
    "severity": "HIGH"
  },
  "details": "Unspecified vulnerability in Microsoft Word 2000 and 2002, Office Word and Word Viewer 2003, Word 2004 and 2004 v. X for Mac, and Works 2004, 2005, and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption, a different vulnerability than CVE-2006-6456.",
  "id": "GHSA-p3mj-fq4c-ffqj",
  "modified": "2022-05-01T07:33:49Z",
  "published": "2022-05-01T07:33:49Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-5994"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30738"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A238"
    },
    {
      "type": "WEB",
      "url": "http://blogs.securiteam.com/?p=759"
    },
    {
      "type": "WEB",
      "url": "http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/23232"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1017339"
    },
    {
      "type": "WEB",
      "url": "http://www.computerworld.com/action/article.do?command=viewArticleBasic\u0026articleId=9005698\u0026intsrc=hm_list"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/167928"
    },
    {
      "type": "WEB",
      "url": "http://www.microsoft.com/technet/security/advisory/929433.mspx"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/30824"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/453735/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/453906/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/454061/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/21451"
    },
    {
      "type": "WEB",
      "url": "http://www.us-cert.gov/cas/techalerts/TA07-044A.html"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2006/4866"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GSD-2006-5994

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2006-5994

Aliases

CVE-2006-5994

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2006-5994",
    "description": "Unspecified vulnerability in Microsoft Word 2000 and 2002, Office Word and Word Viewer 2003, Word 2004 and 2004 v. X for Mac, and Works 2004, 2005, and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption, a different vulnerability than CVE-2006-6456.",
    "id": "GSD-2006-5994"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2006-5994"
      ],
      "details": "Unspecified vulnerability in Microsoft Word 2000 and 2002, Office Word and Word Viewer 2003, Word 2004 and 2004 v. X for Mac, and Works 2004, 2005, and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption, a different vulnerability than CVE-2006-6456.",
      "id": "GSD-2006-5994",
      "modified": "2023-12-13T01:19:56.477347Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secure@microsoft.com",
        "ID": "CVE-2006-5994",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Unspecified vulnerability in Microsoft Word 2000 and 2002, Office Word and Word Viewer 2003, Word 2004 and 2004 v. X for Mac, and Works 2004, 2005, and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption, a different vulnerability than CVE-2006-6456."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "30824",
            "refsource": "OSVDB",
            "url": "http://www.osvdb.org/30824"
          },
          {
            "name": "20061206 Microsoft 0-day word vulnerability - Secunia - Extremely critical",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/453735/100/0/threaded"
          },
          {
            "name": "20061208 Microsoft Word 0-day Vulnerability FAQ (CVE-2006-5994) written",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/453906/100/0/threaded"
          },
          {
            "name": "word-unspecified-code-execution(30738)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30738"
          },
          {
            "name": "http://www.microsoft.com/technet/security/advisory/929433.mspx",
            "refsource": "CONFIRM",
            "url": "http://www.microsoft.com/technet/security/advisory/929433.mspx"
          },
          {
            "name": "23232",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/23232"
          },
          {
            "name": "TA07-044A",
            "refsource": "CERT",
            "url": "http://www.us-cert.gov/cas/techalerts/TA07-044A.html"
          },
          {
            "name": "http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx",
            "refsource": "CONFIRM",
            "url": "http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx"
          },
          {
            "name": "oval:org.mitre.oval:def:238",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A238"
          },
          {
            "name": "http://blogs.securiteam.com/?p=759",
            "refsource": "MISC",
            "url": "http://blogs.securiteam.com/?p=759"
          },
          {
            "name": "ADV-2006-4866",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2006/4866"
          },
          {
            "name": "MS07-014",
            "refsource": "MS",
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014"
          },
          {
            "name": "VU#167928",
            "refsource": "CERT-VN",
            "url": "http://www.kb.cert.org/vuls/id/167928"
          },
          {
            "name": "1017339",
            "refsource": "SECTRACK",
            "url": "http://securitytracker.com/id?1017339"
          },
          {
            "name": "http://www.computerworld.com/action/article.do?command=viewArticleBasic\u0026articleId=9005698\u0026intsrc=hm_list",
            "refsource": "MISC",
            "url": "http://www.computerworld.com/action/article.do?command=viewArticleBasic\u0026articleId=9005698\u0026intsrc=hm_list"
          },
          {
            "name": "21451",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/21451"
          },
          {
            "name": "20061210 Several updates in Microsoft Word 0-day (CVE-2006-5994) FAQ document",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/454061/100/0/threaded"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:xp:sp3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:word:2000:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2003:sp2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2004:*:mac:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:works:2005:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:works:2006:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:word:2002:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:word:2003:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:word_viewer:2003:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:works:2004:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2006-5994"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Unspecified vulnerability in Microsoft Word 2000 and 2002, Office Word and Word Viewer 2003, Word 2004 and 2004 v. X for Mac, and Works 2004, 2005, and 2006 allows remote attackers to execute arbitrary code via a Word document with a malformed string that triggers memory corruption, a different vulnerability than CVE-2006-6456."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.microsoft.com/technet/security/advisory/929433.mspx",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://www.microsoft.com/technet/security/advisory/929433.mspx"
            },
            {
              "name": "http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://blogs.technet.com/msrc/archive/2006/12/06/microsoft-security-advisory-929433-posted.aspx"
            },
            {
              "name": "http://www.computerworld.com/action/article.do?command=viewArticleBasic\u0026articleId=9005698\u0026intsrc=hm_list",
              "refsource": "MISC",
              "tags": [],
              "url": "http://www.computerworld.com/action/article.do?command=viewArticleBasic\u0026articleId=9005698\u0026intsrc=hm_list"
            },
            {
              "name": "21451",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/21451"
            },
            {
              "name": "VU#167928",
              "refsource": "CERT-VN",
              "tags": [
                "US Government Resource"
              ],
              "url": "http://www.kb.cert.org/vuls/id/167928"
            },
            {
              "name": "23232",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/23232"
            },
            {
              "name": "1017339",
              "refsource": "SECTRACK",
              "tags": [],
              "url": "http://securitytracker.com/id?1017339"
            },
            {
              "name": "30824",
              "refsource": "OSVDB",
              "tags": [],
              "url": "http://www.osvdb.org/30824"
            },
            {
              "name": "http://blogs.securiteam.com/?p=759",
              "refsource": "MISC",
              "tags": [],
              "url": "http://blogs.securiteam.com/?p=759"
            },
            {
              "name": "TA07-044A",
              "refsource": "CERT",
              "tags": [
                "US Government Resource"
              ],
              "url": "http://www.us-cert.gov/cas/techalerts/TA07-044A.html"
            },
            {
              "name": "ADV-2006-4866",
              "refsource": "VUPEN",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.vupen.com/english/advisories/2006/4866"
            },
            {
              "name": "word-unspecified-code-execution(30738)",
              "refsource": "XF",
              "tags": [],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30738"
            },
            {
              "name": "oval:org.mitre.oval:def:238",
              "refsource": "OVAL",
              "tags": [],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A238"
            },
            {
              "name": "MS07-014",
              "refsource": "MS",
              "tags": [],
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-014"
            },
            {
              "name": "20061210 Several updates in Microsoft Word 0-day (CVE-2006-5994) FAQ document",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/454061/100/0/threaded"
            },
            {
              "name": "20061208 Microsoft Word 0-day Vulnerability FAQ (CVE-2006-5994) written",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/453906/100/0/threaded"
            },
            {
              "name": "20061206 Microsoft 0-day word vulnerability - Secunia - Extremely critical",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/453735/100/0/threaded"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 10.0,
          "obtainAllPrivilege": true,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": true
        }
      },
      "lastModifiedDate": "2018-10-17T21:46Z",
      "publishedDate": "2006-12-06T20:28Z"
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2006-5994 (GCVE-0-2006-5994)

CERTA-2006-ALE-014

Description

4.1 Alerte du 18 décembre 2006

4.2 Mise à jour du 26 janvier 2007

Contournement provisoire

5.1 Utiliser un format de document alternatif

5.2 Utiliser un logiciel alternatif

5.3 Mettre à jour la base de signatures d'antivirus

5.4 Filtrer les pièces jointes au niveau des passerelles

5.5 N'ouvrir que les documents provenant de sources de confiance

5.6 Limiter l'impact en utilisant un compte utilisateur sans privilège

Solution

CERTA-2007-AVI-083

Description

Solution

FKIE_CVE-2006-5994

GHSA-P3MJ-FQ4C-FFQJ

GSD-2006-5994

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour