CVE-2010-1901: Code Injection
First published: Wed Aug 11 2010(Updated: )
Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP2; Microsoft Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Word Viewer; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 do not properly handle unspecified properties in rich text data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted RTF document, aka "Word RTF Parsing Engine Memory Corruption Vulnerability."
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Office Word | =2002-sp3 | |
| Microsoft Office Word | =2003-sp3 | |
| Microsoft Office Word | =2007-sp2 | |
| Microsoft Office | =2004 | |
| Microsoft Office | =2008 | |
| Microsoft Open XML File Format Converter | ||
| Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint | =2007-sp2 | |
| Microsoft Word Viewer |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2010-1901?
CVE-2010-1901 is rated as critical due to the potential for remote code execution.
How do I fix CVE-2010-1901?
To fix CVE-2010-1901, you should apply the latest security updates provided by Microsoft.
Which versions are affected by CVE-2010-1901?
CVE-2010-1901 affects Microsoft Word 2002 SP3, 2003 SP3, 2007 SP2, and several Microsoft Office versions for Mac.
What type of vulnerability is CVE-2010-1901?
CVE-2010-1901 is a vulnerability that can lead to remote code execution due to improper handling of properties in rich text documents.
Is there a workaround for CVE-2010-1901?
There are no known workarounds for CVE-2010-1901; patching is the recommended solution.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/last-modified-date
- agent/references
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/microsoft
- canonical/microsoft office word
- version/microsoft office word/2002-sp3
- version/microsoft office word/2003-sp3
- version/microsoft office word/2007-sp2
- canonical/microsoft office
- version/microsoft office/2004
- version/microsoft office/2008
- canonical/microsoft open xml file format converter
- canonical/microsoft office compatibility pack for word, excel, and powerpoint
- version/microsoft office compatibility pack for word, excel, and powerpoint/2007-sp2
- canonical/microsoft word viewer