CVE-2006-3649

Description

Buffer overflow in Microsoft Visual Basic for Applications (VBA) SDK 6.0 through 6.4, as used by Microsoft Office 2000 SP3, Office XP SP3, Project 2000 SR1, Project 2002 SP1, Access 2000 Runtime SP3, Visio 2002 SP2, and Works Suite 2004 through 2006, allows user-assisted attackers to execute arbitrary code via unspecified document properties that are not verified when VBA is invoked to open documents.

5.1

CVSS

Severity: Medium

CVSS 2.0 •

EPSS 45.98% Top 5%

Vendor Advisory microsoft.com

Affected: n/a n/a

References

Link	Tags
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-047	vendor advisory
http://www.kb.cert.org/vuls/id/159484	us government resource third party advisory patch
http://secunia.com/advisories/21408	third party advisory
http://www.us-cert.gov/cas/techalerts/TA06-220A.html	us government resource third party advisory patch
http://www.vupen.com/english/advisories/2006/3214	vdb entry
http://www.securityfocus.com/bid/19414	vdb entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A694	vdb entry signature
http://securitytracker.com/id?1016656	vdb entry

Frequently Asked Questions

What is the severity of CVE-2006-3649?: CVE-2006-3649 has been scored as a medium severity vulnerability.
How to fix CVE-2006-3649?: To fix CVE-2006-3649, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-3649 being actively exploited in the wild?: It is possible that CVE-2006-3649 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~46% probability that this vulnerability will be exploited by malicious actors in the next 30 days.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.