CVE-2008-4019

Summary

CVE	CVE-2008-4019
State	PUBLISHED
Assigner	microsoft
Source Priority	CVE Program / NVD first with legacy fallback
Published	2008-10-15 00:12:15 UTC
Updated	2026-04-23 00:35:47 UTC
Description	Integer overflow in the REPT function in Microsoft Excel 2000 SP3, 2002 SP3, 2003 SP2 and SP3, and 2007 Gold and SP1; Office Excel Viewer 2003 SP3; Office Excel Viewer; Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Gold and SP1; Office SharePoint Server 2007 Gold and SP1; Office 2004 and 2008 for Mac; and Open XML File Format Converter for Mac allows remote attackers to execute arbitrary code via an Excel file containing a formula within a cell, aka "Formula Parsing Vulnerability."

Risk And Classification

Primary CVSS: v2.0 9.3 from [email protected]

AV:N/AC:M/Au:N/C:C/I:C/A:C

Problem Types: CWE-190 | n/a

CVSS v2.0 Breakdown

Access Vector

Network

Access Complexity

Medium

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

AV:N/AC:M/Au:N/C:C/I:C/A:C

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Microsoft	Excel	2003	sp2	All	All
Application	Microsoft	Excel	2003	sp3	All	All
Application	Microsoft	Excel	2007	-	All	All
Application	Microsoft	Excel	2007	sp1	All	All
Application	Microsoft	Excel Viewer	-	All	All	All
Application	Microsoft	Excel Viewer	2003	-	All	All
Application	Microsoft	Excel Viewer	2003	sp3	All	All
Application	Microsoft	Office	2004	All	All	All
Application	Microsoft	Office	2008	All	All	All
Application	Microsoft	Office Compatibility Pack	2007	-	All	All
Application	Microsoft	Office Compatibility Pack	2007	sp1	All	All
Application	Microsoft	Open Xml File Format Converter	-	All	All	All
Application	Microsoft	Sharepoint Server	2007	All	All	All
Application	Microsoft	Sharepoint Server	2007	-	All	All
Application	Microsoft	Sharepoint Server	2007	sp1	All	All
Application	Microsoft	Sharepoint Server	2007	sp1	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

References

Reference	Source	Link	Tags
Webmail - OVH	af854a3a-2127-422b-91ae-364da2661108	www.vupen.com	Third Party Advisory
Repository / Oval Repository	af854a3a-2127-422b-91ae-364da2661108	oval.cisecurity.org	Third Party Advisory
Microsoft Excel Formula Parsing Remote Code Execution Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com	Patch, Third Party Advisory, VDB Entry
IBM X-Force Exchange	af854a3a-2127-422b-91ae-364da2661108	exchange.xforce.ibmcloud.com	Third Party Advisory, VDB Entry
IBM X-Force Exchange	af854a3a-2127-422b-91ae-364da2661108	exchange.xforce.ibmcloud.com	Third Party Advisory, VDB Entry
marc.info	af854a3a-2127-422b-91ae-364da2661108	marc.info	Issue Tracking, Mailing List, Third Party Advisory
Microsoft Security Bulletin MS08-057 - Critical \| Microsoft Docs	af854a3a-2127-422b-91ae-364da2661108	docs.microsoft.com	Patch, Vendor Advisory
Microsoft Excel Multiple Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com	af854a3a-2127-422b-91ae-364da2661108	secunia.com	Patch, Vendor Advisory
Microsoft Excel Object, Calendar, and Formula Bugs Let Remote Users Execute Arbitrary Code - SecurityTracker	af854a3a-2127-422b-91ae-364da2661108	www.securitytracker.com	Third Party Advisory, VDB Entry
US-CERT Technical Cyber Security Alert TA08-288A -- Microsoft Updates for Multiple Vulnerabilities	af854a3a-2127-422b-91ae-364da2661108	www.us-cert.gov	Third Party Advisory, US Government Resource
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.