Full Disclosure mailing list archives
New CVE number states Excel Style handling as a separate issue
From: Juha-Matti Laurio <juha-matti.laurio () netti fi>
Date: Tue, 11 Jul 2006 02:56:22 +0300 (EEST)
New CVE http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3431 published recently confirms the information that Microsoft Excel Style handling vulnerability aka Nanika.xls issue is a separate vulnerability. This vulnerability mentioned affects only to Simplified Chinese, Traditional Chinese, Japanese and Korean versions of Excel. This vulnerability (let's say 4th Excel vulnerability) uses Repair Mode too and user interaction is needed. This information has been updated to my First Microsoft Excel 0-day Vulnerability FAQ document at SecuriTeam Blogs. If fix to this vulnerability is included to monthly July updates from Microsoft it's expected that this CVE-2006-3431 is listed in the upcoming security bulletin to clarify the situation. So-called 1st Excel code execution vulnerability reported in June is http://www.microsoft.com/technet/security/advisory/921365.mspx and http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3059 - Juha-Matti _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- New CVE number states Excel Style handling as a separate issue Juha-Matti Laurio (Jul 10)