{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Word 2004 dans la suite bureautique Microsoft Office 2004 pour Mac ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Word 2003 dans la suite bureautique Microsoft Office 2003 Service Pack 1 ou 2 ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Word v.X dans la suite bureautique Microsoft Office v.X pour Mac ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Word 2002 dans la suite bureautique Microsoft Office XP Service Pack 3 ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Suite Microsoft Works 2006 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Suite Microsoft Works 2005 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Visionneuse Microsoft Office Word 2003 (Viewer).",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Suite Microsoft Works 2004 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Word 2000 dans la suite bureautique Microsoft Office 2000 Service Pack 3;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans l\u0027application\nMicrosoft Word, fournie dans la suite bureautique Microsoft Office ou\ndans Microsoft Works. Parmi celles-ci :\n\n-   Microsoft Word ne manipulerait pas convenablement certaines cha\u00eenes\n    de caract\u00e8res incluses dans les documents.\n-   Microsoft Word ne traiterait pas de mani\u00e8re correcte certains\n    documents de type publipostage (ou mail merge). Ce type permet\n    notamment d\u0027imprimer des documents contenant diff\u00e9rentes coordonn\u00e9es\n    de personnes sous un format donn\u00e9.\n\nUne personne malveillante pourrait exploiter l\u0027une de ces vuln\u00e9rabilit\u00e9s\nen construisant un document Word particulier. Lorsque celui-ci est\nouvert sur une machine ayant une version de Word vuln\u00e9rable, il\nex\u00e9cuterait du code arbitraire, et permettrait donc de prendre le\ncontr\u00f4le de la machine.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 MS06-060 de l\u0027\u00e9diteur Microsoft pour\nl\u0027obtention des correctifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-3647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3647"
    },
    {
      "name": "CVE-2006-4534",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4534"
    },
    {
      "name": "CVE-2006-4693",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4693"
    },
    {
      "name": "CVE-2006-3651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3651"
    }
  ],
  "links": [],
  "reference": "CERTA-2006-AVI-440",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-10-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans l\u0027application\nMicrosoft Word, fournie dans la suite bureautique Microsoft Office ou\ndans Microsoft Works.\n\nUne personne malveillante pourrait exploiter l\u0027une d\u0027elles en\nconstruisant un document Word particulier. Lorsque celui-ci est ouvert\nsur une machine ayant une version de Word vuln\u00e9rable, il ex\u00e9cuterait du\ncode arbitraire, et permettrait donc de prendre le contr\u00f4le de la\nmachine.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Word",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS06-060 du 10 octobre 2006",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS06-060.mspx"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Word 2004 dans la suite bureautique Microsoft Office 2004 pour Mac ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Word 2003 dans la suite bureautique Microsoft Office 2003 Service Pack 1 ou 2 ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Word v.X dans la suite bureautique Microsoft Office v.X pour Mac ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Word 2002 dans la suite bureautique Microsoft Office XP Service Pack 3 ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Suite Microsoft Works 2006 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Suite Microsoft Works 2005 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Visionneuse Microsoft Office Word 2003 (Viewer).",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Suite Microsoft Works 2004 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Word 2000 dans la suite bureautique Microsoft Office 2000 Service Pack 3;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nPlusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans l\u0027application\nMicrosoft Word, fournie dans la suite bureautique Microsoft Office ou\ndans Microsoft Works. Parmi celles-ci :\n\n-   Microsoft Word ne manipulerait pas convenablement certaines cha\u00eenes\n    de caract\u00e8res incluses dans les documents.\n-   Microsoft Word ne traiterait pas de mani\u00e8re correcte certains\n    documents de type publipostage (ou mail merge). Ce type permet\n    notamment d\u0027imprimer des documents contenant diff\u00e9rentes coordonn\u00e9es\n    de personnes sous un format donn\u00e9.\n\nUne personne malveillante pourrait exploiter l\u0027une de ces vuln\u00e9rabilit\u00e9s\nen construisant un document Word particulier. Lorsque celui-ci est\nouvert sur une machine ayant une version de Word vuln\u00e9rable, il\nex\u00e9cuterait du code arbitraire, et permettrait donc de prendre le\ncontr\u00f4le de la machine.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 MS06-060 de l\u0027\u00e9diteur Microsoft pour\nl\u0027obtention des correctifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-3647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3647"
    },
    {
      "name": "CVE-2006-4534",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4534"
    },
    {
      "name": "CVE-2006-4693",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4693"
    },
    {
      "name": "CVE-2006-3651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3651"
    }
  ],
  "links": [],
  "reference": "CERTA-2006-AVI-440",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-10-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "Plusieurs vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans l\u0027application\nMicrosoft Word, fournie dans la suite bureautique Microsoft Office ou\ndans Microsoft Works.\n\nUne personne malveillante pourrait exploiter l\u0027une d\u0027elles en\nconstruisant un document Word particulier. Lorsque celui-ci est ouvert\nsur une machine ayant une version de Word vuln\u00e9rable, il ex\u00e9cuterait du\ncode arbitraire, et permettrait donc de prendre le contr\u00f4le de la\nmachine.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Word",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft MS06-060 du 10 octobre 2006",
      "url": "http://www.microsoft.com/technet/security/Bulletin/MS06-060.mspx"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2006-4534",
    "description": "Unspecified vulnerability in Microsoft Word 2000, 2002, and Office 2003 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors involving a crafted file resulting in a malformed stack, as exploited by malware with names including Trojan.Mdropper.Q, Mofei, and Femo.",
    "id": "GSD-2006-4534"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2006-4534"
      ],
      "details": "Unspecified vulnerability in Microsoft Word 2000, 2002, and Office 2003 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors involving a crafted file resulting in a malformed stack, as exploited by malware with names including Trojan.Mdropper.Q, Mofei, and Femo.",
      "id": "GSD-2006-4534",
      "modified": "2023-12-13T01:19:51.780205Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2006-4534",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Unspecified vulnerability in Microsoft Word 2000, 2002, and Office 2003 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors involving a crafted file resulting in a malformed stack, as exploited by malware with names including Trojan.Mdropper.Q, Mofei, and Femo."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "28539",
            "refsource": "OSVDB",
            "url": "http://www.osvdb.org/28539"
          },
          {
            "name": "1016787",
            "refsource": "SECTRACK",
            "url": "http://securitytracker.com/id?1016787"
          },
          {
            "name": "http://www.symantec.com/enterprise/security_response/writeup.jsp?docid=2006-090219-2855-99",
            "refsource": "MISC",
            "url": "http://www.symantec.com/enterprise/security_response/writeup.jsp?docid=2006-090219-2855-99"
          },
          {
            "name": "SSRT061264",
            "refsource": "HP",
            "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
          },
          {
            "name": "19835",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/19835"
          },
          {
            "name": "MS06-060",
            "refsource": "MS",
            "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-060"
          },
          {
            "name": "ADV-2006-3448",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2006/3448"
          },
          {
            "name": "20060906 Microsoft confirmed Word 0-day vulnerability",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/445381/100/0/threaded"
          },
          {
            "name": "http://blogs.securiteam.com/?p=586",
            "refsource": "MISC",
            "url": "http://blogs.securiteam.com/?p=586"
          },
          {
            "name": "HPSBST02161",
            "refsource": "HP",
            "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
          },
          {
            "name": "ms-word-code-execution(28775)",
            "refsource": "XF",
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28775"
          },
          {
            "name": "21735",
            "refsource": "SECUNIA",
            "url": "http://secunia.com/advisories/21735"
          },
          {
            "name": "Q925059",
            "refsource": "MSKB",
            "url": "http://support.microsoft.com/kb/925059"
          },
          {
            "name": "20060906 Re: Microsoft Word 0-day Vulnerability (September) FAQ document available",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/445285/100/0/threaded"
          },
          {
            "name": "http://vil.mcafeesecurity.com/vil/content/v_119055.htm",
            "refsource": "MISC",
            "url": "http://vil.mcafeesecurity.com/vil/content/v_119055.htm"
          },
          {
            "name": "VU#806548",
            "refsource": "CERT-VN",
            "url": "http://www.kb.cert.org/vuls/id/806548"
          },
          {
            "name": "http://www.microsoft.com/technet/security/advisory/925059.mspx",
            "refsource": "CONFIRM",
            "url": "http://www.microsoft.com/technet/security/advisory/925059.mspx"
          },
          {
            "name": "20060905 Microsoft Word 0-day Vulnerability (September) FAQ document available",
            "refsource": "BUGTRAQ",
            "url": "http://www.securityfocus.com/archive/1/445162/100/100/threaded"
          },
          {
            "name": "oval:org.mitre.oval:def:578",
            "refsource": "OVAL",
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A578"
          },
          {
            "name": "http://isc.sans.org/diary.php?storyid=1669",
            "refsource": "MISC",
            "url": "http://isc.sans.org/diary.php?storyid=1669"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2000:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2001:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2001:*:*:*:*:mac_os:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2001:sr1:*:*:*:mac_os:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2000:*:*:ko:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2000:sp1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2003:sp2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2000:*:*:zh:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2000:*:*:ja:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2003:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2003:sp1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2000:sp2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-4534"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Unspecified vulnerability in Microsoft Word 2000, 2002, and Office 2003 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors involving a crafted file resulting in a malformed stack, as exploited by malware with names including Trojan.Mdropper.Q, Mofei, and Femo."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://blogs.securiteam.com/?p=586",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://blogs.securiteam.com/?p=586"
            },
            {
              "name": "http://isc.sans.org/diary.php?storyid=1669",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://isc.sans.org/diary.php?storyid=1669"
            },
            {
              "name": "http://www.symantec.com/enterprise/security_response/writeup.jsp?docid=2006-090219-2855-99",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://www.symantec.com/enterprise/security_response/writeup.jsp?docid=2006-090219-2855-99"
            },
            {
              "name": "http://vil.mcafeesecurity.com/vil/content/v_119055.htm",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://vil.mcafeesecurity.com/vil/content/v_119055.htm"
            },
            {
              "name": "19835",
              "refsource": "BID",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://www.securityfocus.com/bid/19835"
            },
            {
              "name": "21735",
              "refsource": "SECUNIA",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://secunia.com/advisories/21735"
            },
            {
              "name": "http://www.microsoft.com/technet/security/advisory/925059.mspx",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.microsoft.com/technet/security/advisory/925059.mspx"
            },
            {
              "name": "1016787",
              "refsource": "SECTRACK",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://securitytracker.com/id?1016787"
            },
            {
              "name": "Q925059",
              "refsource": "MSKB",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://support.microsoft.com/kb/925059"
            },
            {
              "name": "VU#806548",
              "refsource": "CERT-VN",
              "tags": [
                "Third Party Advisory",
                "US Government Resource"
              ],
              "url": "http://www.kb.cert.org/vuls/id/806548"
            },
            {
              "name": "28539",
              "refsource": "OSVDB",
              "tags": [
                "Broken Link"
              ],
              "url": "http://www.osvdb.org/28539"
            },
            {
              "name": "ADV-2006-3448",
              "refsource": "VUPEN",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://www.vupen.com/english/advisories/2006/3448"
            },
            {
              "name": "ms-word-code-execution(28775)",
              "refsource": "XF",
              "tags": [
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28775"
            },
            {
              "name": "oval:org.mitre.oval:def:578",
              "refsource": "OVAL",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A578"
            },
            {
              "name": "MS06-060",
              "refsource": "MS",
              "tags": [],
              "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-060"
            },
            {
              "name": "SSRT061264",
              "refsource": "HP",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
            },
            {
              "name": "20060906 Microsoft confirmed Word 0-day vulnerability",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/445381/100/0/threaded"
            },
            {
              "name": "20060906 Re: Microsoft Word 0-day Vulnerability (September) FAQ document available",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/445285/100/0/threaded"
            },
            {
              "name": "20060905 Microsoft Word 0-day Vulnerability (September) FAQ document available",
              "refsource": "BUGTRAQ",
              "tags": [],
              "url": "http://www.securityfocus.com/archive/1/445162/100/100/threaded"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 10.0,
          "obtainAllPrivilege": true,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "HIGH",
          "userInteractionRequired": true
        }
      },
      "lastModifiedDate": "2018-10-30T16:25Z",
      "publishedDate": "2006-09-05T17:04Z"
    }
  }
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:office:2000:*:*:*:*:*:*:*",
              "matchCriteriaId": "A9A82D13-513C-46FA-AF51-0582233E230A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2000:*:*:ja:*:*:*:*",
              "matchCriteriaId": "757EC6C1-F5E2-45CD-9F7F-7760ECEDC842",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2000:*:*:ko:*:*:*:*",
              "matchCriteriaId": "59B1B68C-86F1-4FA4-9F82-3E8761ED1E74",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2000:*:*:zh:*:*:*:*",
              "matchCriteriaId": "716DDA05-D094-4837-852C-0511CDDD5ABC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2000:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "3C54DDAF-8D7F-4A7D-9186-6048D4C850B2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2000:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "67388076-420D-4327-A436-329177EA6F42",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2000:sp3:*:*:*:*:*:*",
              "matchCriteriaId": "4891122F-AD7F-45E6-98C6-833227916F6B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2001:*:*:*:*:*:*:*",
              "matchCriteriaId": "64B3099E-DFA0-4C7E-B016-370028BF8387",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2001:*:*:*:*:mac_os:*:*",
              "matchCriteriaId": "43AE142C-E7AD-418E-BA9B-887285EE9620",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2001:sr1:*:*:*:mac_os:*:*",
              "matchCriteriaId": "23E6544C-3695-45E6-A8AD-2F3A3B574915",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2003:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB7EA4CC-E705-42DB-86B6-E229DA36B66D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2003:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "4EED9D78-AE73-44BA-A1CE-603994E92E89",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2003:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "07D3F3E4-93FB-481A-94D9-075E726697C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*",
              "matchCriteriaId": "A332D04D-CC8C-4F68-A261-BA2F2D8EAD1E",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unspecified vulnerability in Microsoft Word 2000, 2002, and Office 2003 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors involving a crafted file resulting in a malformed stack, as exploited by malware with names including Trojan.Mdropper.Q, Mofei, and Femo."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad no especificada en Microsoft Word 2000, 2002 y Office 2003 permite a atacantes remotos asistidos por el usuario ejecutar c\u00f3digo arbitrario a trav\u00e9s de vectores no especificados involucrando un archivo manipulado que resulta de una pila mal formada, como explotado por malware con nombres que incluyen Trojan.Mdropper.Q, Mofei y Femo."
    }
  ],
  "id": "CVE-2006-4534",
  "lastModified": "2025-04-03T01:03:51.193",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": true,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2006-09-05T17:04:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://blogs.securiteam.com/?p=586"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://isc.sans.org/diary.php?storyid=1669"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/21735"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://securitytracker.com/id?1016787"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://support.microsoft.com/kb/925059"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://vil.mcafeesecurity.com/vil/content/v_119055.htm"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/806548"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.microsoft.com/technet/security/advisory/925059.mspx"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.osvdb.org/28539"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/445162/100/100/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/445285/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/445381/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/19835"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://www.symantec.com/enterprise/security_response/writeup.jsp?docid=2006-090219-2855-99"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2006/3448"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-060"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28775"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A578"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://blogs.securiteam.com/?p=586"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://isc.sans.org/diary.php?storyid=1669"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/21735"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://securitytracker.com/id?1016787"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://support.microsoft.com/kb/925059"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://vil.mcafeesecurity.com/vil/content/v_119055.htm"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/806548"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.microsoft.com/technet/security/advisory/925059.mspx"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Broken Link"
      ],
      "url": "http://www.osvdb.org/28539"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/445162/100/100/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/445285/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/445381/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/19835"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://www.symantec.com/enterprise/security_response/writeup.jsp?docid=2006-090219-2855-99"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2006/3448"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-060"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28775"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A578"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Works versions 8.0 et 8.5 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Suite bureautique Mac Office versions v.X et 2004 ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Suite bureautique Microsoft Office versions 2000SP3, 2002SP2, 2002SP3, 2003SP1, 2003SP2 ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Internet Explorer et famille Outlook.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Wordpad toutes versions ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2006-10-11",
  "content": "## Description\n\n-   Un grand nombre de vuln\u00e9rabilit\u00e9s r\u00e9v\u00e9l\u00e9es publiquement affectent la\n    gamme Office. Ces vuln\u00e9rabilit\u00e9s peuvent \u00eatre exploit\u00e9es par le\n    biais de documents malicieusement contruits dont l\u0027ouverture peut\n    provoquer l\u0027ex\u00e9cution de commandes dans le contexte utilisateur.\n-   Plusieurs autres vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans des\n    versions d\u0027Internet Explorer. Ces vuln\u00e9rabilit\u00e9s permettent \u00e0 un\n    attaquant de compromettre le navigateur, directement ou par le biais\n    d\u0027une dll vuln\u00e9rable (vgx.dll). Cette biblioth\u00e8que est utilis\u00e9e pour\n    prendre en compte le format VML (Vector Markup Vector Language). Ce\n    format fond\u00e9 sur le langage XML est utilis\u00e9 pour \u00e9diter certaines\n    images. Deux vecteurs d\u0027attaques sont possibles :\n    -   via une page HTML sp\u00e9cifiquement con\u00e7ue pour exploiter la faille\n        d\u0027Internet Explorer ;\n    -   via des messages \u00e9lectroniques qui seraient lus \u00e0 l\u0027aide des\n        clients de la famille d\u0027Outlook avec prise en compte du langage\n        HTML. Des messages malicieux se propagent d\u00e9ja sur l\u0027Internet.\n-   Comme cela a \u00e9t\u00e9 d\u00e9ja soulign\u00e9 \u00e0 de nombreuses reprises par le\n    CERTA, il est fortement recommand\u00e9 de d\u00e9sactiver par d\u00e9faut les\n    options ActiveX et les scripts en g\u00e9n\u00e9ral en choisissant\n    \u00e9ventuellement leur activation pour les sites de confiance\n    n\u00e9cessitant l\u0027usage de tels composants ou programmes.\n\nUn bulletin de s\u00e9curit\u00e9 Microsoft annonce officiellement une\nvuln\u00e9rabilit\u00e9 dans MS Office Word 2000. Une r\u00e9f\u00e9rence CVE est associ\u00e9e \u00e0\ncette vuln\u00e9rabilit\u00e9, qui est exploit\u00e9e actuellement par du code\nmalveillant.\n\n## Contournement provisoire\n\n**Suite bureautique MS-Office**\n:   N\u0027ouvrir que les documents bureautiques de confiance, et utiliser\n    une suite bureautique alternative \u00e0 jour (OpenOffice, par exemple).\n\n**Internet Explorer 1**\n:   Utiliser un navigateur alternatif \u00e0 jour (Mozilla, Firefox, Op\u00e9ra,\n    etc...)\n\n**Internet Explorer 2**\n:   D\u00e9sactiver les options ActiveX, les scripts (cf. bulletin\n    d\u0027actualit\u00e9 du CERTA)\n\n**Internet Explorer 3 et Outlook**\n:   D\u00e9sactiver la biblioth\u00e8que vgx.dll :\n    \u003cdiv markdown=\"1\" align=\"center\"\u003e\n\n    \u003cspan\n    class=\"small\"\u003e`regsvr32.exe        \"%CommonProgramFiles%\\Microsoft Shared\\VGX\\vgx.dll\"        -u`\u003c/span\u003e\n\n    \u003c/div\u003e\n\nUne mise \u00e0 jour de s\u00e9curit\u00e9, publi\u00e9e par Microsoft, est d\u00e9sormais\ndisponible. Elle permet de corriger une des vuln\u00e9rabilit\u00e9s cit\u00e9es dans\nce bulletin d\u0027alerte, en l\u0027occurence celle pr\u00e9sente dans la biblioth\u00e8que\nvgx.dll. Un bulletin de s\u00e9curit\u00e9 du CERTA reprend cette vuln\u00e9rabilit\u00e9\nainsi que la solution associ\u00e9e.\n\nSe r\u00e9f\u00e9rer \u00e0 l\u0027avis du CERTA r\u00e9f\u00e9renc\u00e9 CERTA-2006-AVI-410 du 27\nseptembre 2006 diponible \u00e0 l\u0027adresse suivante :\n\n    http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-410/index.html\n\n## Solution\n\nSe r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour obtenir les mises\n\u00e0 jour (cf. Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-4534",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4534"
    },
    {
      "name": "CVE-2006-3866",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3866"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft 925444 :",
      "url": "http://www.microsoft.com/technet/security/advisory/925444.mspx"
    },
    {
      "title": "Bulletin de mise \u00e0 jour Microsoft MS06-055 :",
      "url": "http://www.microsoft.com/technet/security/bulletin/MS06-055.mspx"
    },
    {
      "title": "Avis du CERTA numeros CERTA-2006-AVI-410,    CERTA-2006-AVI-438, CERTA-2006-AVI-439, CERTA-2006-AVI-440,    CERTA-2006-AVI-442 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-438/index.html"
    },
    {
      "title": "Bulletin de mise \u00e0 jour Microsoft MS06-058 :",
      "url": "http://www.microsoft.com/technet/security/bulletin/MS06-058.mspx"
    },
    {
      "title": "Bulletin d\u0027actualit\u00e9 (N\u00b027)du CERTA :",
      "url": "http://www.certa.ssi.gouv.fr/site/certa-2006-ACT-027.pdf"
    },
    {
      "title": "Bulletin d\u0027actualit\u00e9 (N\u00b030)du CERTA :",
      "url": "http://www.certa.ssi.gouv.fr/site/certa-2006-ACT-030.pdf"
    },
    {
      "title": "Avis du CERTA numeros CERTA-2006-AVI-410,    CERTA-2006-AVI-438, CERTA-2006-AVI-439, CERTA-2006-AVI-440,    CERTA-2006-AVI-442 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-440/index.html"
    },
    {
      "title": "Bulletin de mise \u00e0 jour Microsoft MS06-059 :",
      "url": "http://www.microsoft.com/technet/security/bulletin/MS06-059.mspx"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft 925568 :",
      "url": "http://www.microsoft.com/technet/security/advisory/925568.mspx"
    },
    {
      "title": "Bulletin d\u0027actualit\u00e9 (N\u00b037)du CERTA :",
      "url": "http://www.certa.ssi.gouv.fr/site/certa-2006-ACT-037.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft 925059 :",
      "url": "http://www.microsoft.com/technet/security/advisory/925059.mspx"
    },
    {
      "title": "Avis du CERTA numeros CERTA-2006-AVI-410,    CERTA-2006-AVI-438, CERTA-2006-AVI-439, CERTA-2006-AVI-440,    CERTA-2006-AVI-442 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-442/index.html"
    },
    {
      "title": "Bulletin de mise \u00e0 jour Microsoft MS06-060 :",
      "url": "http://www.microsoft.com/technet/security/bulletin/MS06-060.mspx"
    },
    {
      "title": "Avis du CERTA numeros CERTA-2006-AVI-410,    CERTA-2006-AVI-438, CERTA-2006-AVI-439, CERTA-2006-AVI-440,    CERTA-2006-AVI-442 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-439/index.html"
    },
    {
      "title": "Avis du CERTA numeros CERTA-2006-AVI-410,    CERTA-2006-AVI-438, CERTA-2006-AVI-439, CERTA-2006-AVI-440,    CERTA-2006-AVI-442 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-410/index.html"
    },
    {
      "title": "Bulletin de mise \u00e0 jour Microsoft MS06-062 :",
      "url": "http://www.microsoft.com/technet/security/bulletin/MS06-062.mspx"
    }
  ],
  "reference": "CERTA-2006-ALE-011",
  "revisions": [
    {
      "description": "Version initiale.",
      "revision_date": "2006-08-31T00:00:00.000000"
    },
    {
      "description": "Diffusion de code.",
      "revision_date": "2006-09-05T00:00:00.000000"
    },
    {
      "description": "Rappels sur les ActiveX.",
      "revision_date": "2006-09-19T00:00:00.000000"
    },
    {
      "description": "Ajouts r\u00e9f\u00e9rences Microsoft et CVE.",
      "revision_date": "2006-09-20T00:00:00.000000"
    },
    {
      "description": "Ajout diffusion via la messagerie.",
      "revision_date": "2006-09-22T00:00:00.000000"
    },
    {
      "description": "Ajout de la r\u00e9f\u00e9rence \u00e0 l\u0027avis CERTA r\u00e9f\u00e9renc\u00e9 CERTA-2006-AVI-410.",
      "revision_date": "2006-09-27T00:00:00.000000"
    },
    {
      "description": "Ajout de la solution et mise en forme.",
      "revision_date": "2006-10-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s affectent certains produits de l\u0027\u00e9diteur\nMicrosoft. Ces vuln\u00e9rabilit\u00e9s peuvent \u00eatre exploit\u00e9es par un utilisateur\nmal intentionn\u00e9 afin de provoquer un d\u00e9ni de service ou une ex\u00e9cution de\ncode arbitraire \u00e0 distance sur la machine cible. Des codes malveillants\nexploitant certaines de ces vuln\u00e9rabilit\u00e9s sont disponibles sur\nl\u0027Internet.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s de produits Microsoft",
  "vendor_advisories": []
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Works versions 8.0 et 8.5 ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Suite bureautique Mac Office versions v.X et 2004 ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Suite bureautique Microsoft Office versions 2000SP3, 2002SP2, 2002SP3, 2003SP1, 2003SP2 ;",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Internet Explorer et famille Outlook.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Wordpad toutes versions ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2006-10-11",
  "content": "## Description\n\n-   Un grand nombre de vuln\u00e9rabilit\u00e9s r\u00e9v\u00e9l\u00e9es publiquement affectent la\n    gamme Office. Ces vuln\u00e9rabilit\u00e9s peuvent \u00eatre exploit\u00e9es par le\n    biais de documents malicieusement contruits dont l\u0027ouverture peut\n    provoquer l\u0027ex\u00e9cution de commandes dans le contexte utilisateur.\n-   Plusieurs autres vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans des\n    versions d\u0027Internet Explorer. Ces vuln\u00e9rabilit\u00e9s permettent \u00e0 un\n    attaquant de compromettre le navigateur, directement ou par le biais\n    d\u0027une dll vuln\u00e9rable (vgx.dll). Cette biblioth\u00e8que est utilis\u00e9e pour\n    prendre en compte le format VML (Vector Markup Vector Language). Ce\n    format fond\u00e9 sur le langage XML est utilis\u00e9 pour \u00e9diter certaines\n    images. Deux vecteurs d\u0027attaques sont possibles :\n    -   via une page HTML sp\u00e9cifiquement con\u00e7ue pour exploiter la faille\n        d\u0027Internet Explorer ;\n    -   via des messages \u00e9lectroniques qui seraient lus \u00e0 l\u0027aide des\n        clients de la famille d\u0027Outlook avec prise en compte du langage\n        HTML. Des messages malicieux se propagent d\u00e9ja sur l\u0027Internet.\n-   Comme cela a \u00e9t\u00e9 d\u00e9ja soulign\u00e9 \u00e0 de nombreuses reprises par le\n    CERTA, il est fortement recommand\u00e9 de d\u00e9sactiver par d\u00e9faut les\n    options ActiveX et les scripts en g\u00e9n\u00e9ral en choisissant\n    \u00e9ventuellement leur activation pour les sites de confiance\n    n\u00e9cessitant l\u0027usage de tels composants ou programmes.\n\nUn bulletin de s\u00e9curit\u00e9 Microsoft annonce officiellement une\nvuln\u00e9rabilit\u00e9 dans MS Office Word 2000. Une r\u00e9f\u00e9rence CVE est associ\u00e9e \u00e0\ncette vuln\u00e9rabilit\u00e9, qui est exploit\u00e9e actuellement par du code\nmalveillant.\n\n## Contournement provisoire\n\n**Suite bureautique MS-Office**\n:   N\u0027ouvrir que les documents bureautiques de confiance, et utiliser\n    une suite bureautique alternative \u00e0 jour (OpenOffice, par exemple).\n\n**Internet Explorer 1**\n:   Utiliser un navigateur alternatif \u00e0 jour (Mozilla, Firefox, Op\u00e9ra,\n    etc...)\n\n**Internet Explorer 2**\n:   D\u00e9sactiver les options ActiveX, les scripts (cf. bulletin\n    d\u0027actualit\u00e9 du CERTA)\n\n**Internet Explorer 3 et Outlook**\n:   D\u00e9sactiver la biblioth\u00e8que vgx.dll :\n    \u003cdiv markdown=\"1\" align=\"center\"\u003e\n\n    \u003cspan\n    class=\"small\"\u003e`regsvr32.exe        \"%CommonProgramFiles%\\Microsoft Shared\\VGX\\vgx.dll\"        -u`\u003c/span\u003e\n\n    \u003c/div\u003e\n\nUne mise \u00e0 jour de s\u00e9curit\u00e9, publi\u00e9e par Microsoft, est d\u00e9sormais\ndisponible. Elle permet de corriger une des vuln\u00e9rabilit\u00e9s cit\u00e9es dans\nce bulletin d\u0027alerte, en l\u0027occurence celle pr\u00e9sente dans la biblioth\u00e8que\nvgx.dll. Un bulletin de s\u00e9curit\u00e9 du CERTA reprend cette vuln\u00e9rabilit\u00e9\nainsi que la solution associ\u00e9e.\n\nSe r\u00e9f\u00e9rer \u00e0 l\u0027avis du CERTA r\u00e9f\u00e9renc\u00e9 CERTA-2006-AVI-410 du 27\nseptembre 2006 diponible \u00e0 l\u0027adresse suivante :\n\n    http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-410/index.html\n\n## Solution\n\nSe r\u00e9f\u00e9rer aux bulletins de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour obtenir les mises\n\u00e0 jour (cf. Documentation).\n",
  "cves": [
    {
      "name": "CVE-2006-4534",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-4534"
    },
    {
      "name": "CVE-2006-3866",
      "url": "https://www.cve.org/CVERecord?id=CVE-2006-3866"
    }
  ],
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft 925444 :",
      "url": "http://www.microsoft.com/technet/security/advisory/925444.mspx"
    },
    {
      "title": "Bulletin de mise \u00e0 jour Microsoft MS06-055 :",
      "url": "http://www.microsoft.com/technet/security/bulletin/MS06-055.mspx"
    },
    {
      "title": "Avis du CERTA numeros CERTA-2006-AVI-410,    CERTA-2006-AVI-438, CERTA-2006-AVI-439, CERTA-2006-AVI-440,    CERTA-2006-AVI-442 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-438/index.html"
    },
    {
      "title": "Bulletin de mise \u00e0 jour Microsoft MS06-058 :",
      "url": "http://www.microsoft.com/technet/security/bulletin/MS06-058.mspx"
    },
    {
      "title": "Bulletin d\u0027actualit\u00e9 (N\u00b027)du CERTA :",
      "url": "http://www.certa.ssi.gouv.fr/site/certa-2006-ACT-027.pdf"
    },
    {
      "title": "Bulletin d\u0027actualit\u00e9 (N\u00b030)du CERTA :",
      "url": "http://www.certa.ssi.gouv.fr/site/certa-2006-ACT-030.pdf"
    },
    {
      "title": "Avis du CERTA numeros CERTA-2006-AVI-410,    CERTA-2006-AVI-438, CERTA-2006-AVI-439, CERTA-2006-AVI-440,    CERTA-2006-AVI-442 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-440/index.html"
    },
    {
      "title": "Bulletin de mise \u00e0 jour Microsoft MS06-059 :",
      "url": "http://www.microsoft.com/technet/security/bulletin/MS06-059.mspx"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft 925568 :",
      "url": "http://www.microsoft.com/technet/security/advisory/925568.mspx"
    },
    {
      "title": "Bulletin d\u0027actualit\u00e9 (N\u00b037)du CERTA :",
      "url": "http://www.certa.ssi.gouv.fr/site/certa-2006-ACT-037.pdf"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft 925059 :",
      "url": "http://www.microsoft.com/technet/security/advisory/925059.mspx"
    },
    {
      "title": "Avis du CERTA numeros CERTA-2006-AVI-410,    CERTA-2006-AVI-438, CERTA-2006-AVI-439, CERTA-2006-AVI-440,    CERTA-2006-AVI-442 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-442/index.html"
    },
    {
      "title": "Bulletin de mise \u00e0 jour Microsoft MS06-060 :",
      "url": "http://www.microsoft.com/technet/security/bulletin/MS06-060.mspx"
    },
    {
      "title": "Avis du CERTA numeros CERTA-2006-AVI-410,    CERTA-2006-AVI-438, CERTA-2006-AVI-439, CERTA-2006-AVI-440,    CERTA-2006-AVI-442 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-439/index.html"
    },
    {
      "title": "Avis du CERTA numeros CERTA-2006-AVI-410,    CERTA-2006-AVI-438, CERTA-2006-AVI-439, CERTA-2006-AVI-440,    CERTA-2006-AVI-442 :",
      "url": "http://www.certa.ssi.gouv.fr/site/CERTA-2006-AVI-410/index.html"
    },
    {
      "title": "Bulletin de mise \u00e0 jour Microsoft MS06-062 :",
      "url": "http://www.microsoft.com/technet/security/bulletin/MS06-062.mspx"
    }
  ],
  "reference": "CERTA-2006-ALE-011",
  "revisions": [
    {
      "description": "Version initiale.",
      "revision_date": "2006-08-31T00:00:00.000000"
    },
    {
      "description": "Diffusion de code.",
      "revision_date": "2006-09-05T00:00:00.000000"
    },
    {
      "description": "Rappels sur les ActiveX.",
      "revision_date": "2006-09-19T00:00:00.000000"
    },
    {
      "description": "Ajouts r\u00e9f\u00e9rences Microsoft et CVE.",
      "revision_date": "2006-09-20T00:00:00.000000"
    },
    {
      "description": "Ajout diffusion via la messagerie.",
      "revision_date": "2006-09-22T00:00:00.000000"
    },
    {
      "description": "Ajout de la r\u00e9f\u00e9rence \u00e0 l\u0027avis CERTA r\u00e9f\u00e9renc\u00e9 CERTA-2006-AVI-410.",
      "revision_date": "2006-09-27T00:00:00.000000"
    },
    {
      "description": "Ajout de la solution et mise en forme.",
      "revision_date": "2006-10-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s affectent certains produits de l\u0027\u00e9diteur\nMicrosoft. Ces vuln\u00e9rabilit\u00e9s peuvent \u00eatre exploit\u00e9es par un utilisateur\nmal intentionn\u00e9 afin de provoquer un d\u00e9ni de service ou une ex\u00e9cution de\ncode arbitraire \u00e0 distance sur la machine cible. Des codes malveillants\nexploitant certaines de ces vuln\u00e9rabilit\u00e9s sont disponibles sur\nl\u0027Internet.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s de produits Microsoft",
  "vendor_advisories": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2006-4534"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2006-09-05T17:04:00Z",
    "severity": "HIGH"
  },
  "details": "Unspecified vulnerability in Microsoft Word 2000, 2002, and Office 2003 allows remote user-assisted attackers to execute arbitrary code via unspecified vectors involving a crafted file resulting in a malformed stack, as exploited by malware with names including Trojan.Mdropper.Q, Mofei, and Femo.",
  "id": "GHSA-22r5-83g8-x228",
  "modified": "2022-05-01T07:19:33Z",
  "published": "2022-05-01T07:19:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4534"
    },
    {
      "type": "WEB",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-060"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28775"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A578"
    },
    {
      "type": "WEB",
      "url": "http://blogs.securiteam.com/?p=586"
    },
    {
      "type": "WEB",
      "url": "http://isc.sans.org/diary.php?storyid=1669"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/21735"
    },
    {
      "type": "WEB",
      "url": "http://securitytracker.com/id?1016787"
    },
    {
      "type": "WEB",
      "url": "http://support.microsoft.com/kb/925059"
    },
    {
      "type": "WEB",
      "url": "http://vil.mcafeesecurity.com/vil/content/v_119055.htm"
    },
    {
      "type": "WEB",
      "url": "http://www.kb.cert.org/vuls/id/806548"
    },
    {
      "type": "WEB",
      "url": "http://www.microsoft.com/technet/security/advisory/925059.mspx"
    },
    {
      "type": "WEB",
      "url": "http://www.osvdb.org/28539"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/445162/100/100/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/445285/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/445381/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/archive/1/449179/100/0/threaded"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/19835"
    },
    {
      "type": "WEB",
      "url": "http://www.symantec.com/enterprise/security_response/writeup.jsp?docid=2006-090219-2855-99"
    },
    {
      "type": "WEB",
      "url": "http://www.vupen.com/english/advisories/2006/3448"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}