Description
Microsoft Office Word 2000 SP3 and 2002 SP3 and Office 2004 for Mac allow remote attackers to execute arbitrary code via a Word document with a crafted lcbPlcfBkfSdt field in the File Information Block (FIB), which bypasses an initialization step and triggers an "arbitrary free," aka "Word Memory Corruption Vulnerability."
References
- MS08-072 vendor-advisory
- 20081210 CORE-2008-0228: Microsoft Word Malformed FIB Arbitrary Free Vulnerability mailing-list
- oval:org.mitre.oval:def:5934 vdb-entry signature
- http://www.coresecurity.com/files/attachments/CORE-2008-0228-Word.pdf
- 1021370 vdb-entry
- TA08-344A third-party-advisory
- ADV-2008-3384 vdb-entry
- http://www.coresecurity.com/content/word-arbitrary-free