| |
ID ▼ |
Type ▼ |
Status ▼ |
Priority ▼ |
Milestone ▼ |
Owner ▼ |
Summary + Labels ▼ |
... |
|
|
107 |
----
|
Fixed
|
----
|
----
|
hawkes@google.com
|
Microsoft Office 2007 TTDeleteEmbeddedFont handle double delete
CCProjectZeroMembers
|
|
|
|
108 |
----
|
Fixed
|
----
|
----
|
hawkes@google.com
|
Microsoft Office 2007 lcbPlcffndTxt/fcPlfguidUim memory corruption
CCProjectZeroMembers
|
|
|
|
110 |
----
|
Fixed
|
----
|
----
|
hawkes@google.com
|
Microsoft Office 2007 PapxFkp rgbx bOffset memory corruption
CCProjectZeroMembers
|
|
|
|
111 |
----
|
Fixed
|
----
|
----
|
hawkes@google.com
|
Microsoft Office 2007 VBA ExtendedControl use-after-free
CCProjectZeroMembers
|
|
|
|
117 |
----
|
Fixed
|
----
|
----
|
hawkes@google.com
|
Microsoft Office 2007 MsoDrawingGroup rgChildRec invalid GlobalFree
CCProjectZeroMembers
|
|
|
|
119 |
----
|
Fixed
|
----
|
----
|
hawkes@google.com
|
Microsoft Office 2007 BoundSheet dt use-after-free
CCProjectZeroMembers
|
|
|
|
129 |
----
|
Fixed
|
----
|
----
|
hawkes@google.com
|
Microsoft Office 2007 dispatch table out-of-bounds function call
CCProjectZeroMembers
|
|
|
|
132 |
----
|
Fixed
|
----
|
----
|
hawkes@google.com
|
Microsoft Office 2007 shape drawing object use-after-free
CCProjectZeroMembers
|
|
|
|
170 |
----
|
Fixed
|
----
|
----
|
hawkes@google.com
|
Microsoft Office 2007 malformed document stack-based buffer overflow
CCProjectZeroMembers
|
|
|
|
171 |
----
|
Fixed
|
----
|
----
|
hawkes@google.com
|
Microsoft Office 2007 OneTableDocumentStream invalid object
CCProjectZeroMembers
|
|
|
|
226 |
----
|
Fixed
|
----
|
----
|
hawkes@google.com
|
Microsoft Office 2007/2010 RTF callout drawing primitive memory corruption
CCProjectZeroMembers
|
|
|
|
230 |
----
|
Fixed
|
----
|
----
|
hawkes@google.com
|
Microsoft Office 2007 RTF XML SmartTags use-after-free
CCProjectZeroMembers
|
|
|
|
308 |
----
|
Fixed
|
----
|
----
|
hawkes@google.com
|
Microsoft Office 2007 WordPerfect Memory Corruption
CCProjectZeroMembers
|
|
|
|
315 |
----
|
Fixed
|
----
|
----
|
hawkes@google.com
|
Microsoft Office WordPerfect Invalid Copy Destination
CCProjectZeroMembers
|
|
|
|
317 |
----
|
Duplicate
|
----
|
----
|
hawkes@google.com
|
Microsoft Office WordPerfect Invalid XOR
CCProjectZeroMembers
|
|
|
|
379 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office 2007: object vtable memory corruption
CCProjectZeroMembers
|
|
|
|
387 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office 2007 and 2010 use after free vulnerability
CCProjectZeroMembers
|
|
|
|
414 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office 2007 UaF in MSO.dll
CCProjectZeroMembers
|
|
|
|
417 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office 2007 MSO.dll Arbitrary Free
CCProjectZeroMembers
|
|
|
|
420 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office 2007 OGL.dll DpOutputSpanStretch::OutputSpan out of bounds write
CCProjectZeroMembers
|
|
|
|
423 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office 2007 wwlib.dll type confusion
CCProjectZeroMembers
|
|
|
|
424 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office 2007 wwlib.dll fcPlcfFldMom uninitialized heap usage
CCProjectZeroMembers
|
|
|
|
431 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office 2007 MSPTLS heap index integer underflow
CCProjectZeroMembers
|
|
|
|
462 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office Excel 2007, 2010, 2013 UaF with BIFFRecord
CCProjectZeroMembers
|
|
|
|
464 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office 2007 BIFFRecord Length UaF
CCProjectZeroMembers
|
|
|
|
465 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office 2007: type confusion related to OLESSDirectyEntry.CreateTime
CCProjectZeroMembers
|
|
|
|
469 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office 2007: OGL.dll ValidateBitmapInfo bounds check failure
CCProjectZeroMembers
|
|
|
|
488 |
----
|
WontFix
|
----
|
----
|
scvitti@google.com
|
Microsoft Office 2007 and 2010 RTF frmtxtbrl EIP corruption
CCProjectZeroMembers
|
|
|
|
514 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office / COM Object DLL Planting with els.dll
CCProjectZeroMembers
|
|
|
|
555 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office / COM Object DLL Planting with WMALFXGFXDSP.dll
CCProjectZeroMembers
|
|
|
|
556 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office / COM Object DLL Planting with comsvcs.dll delay load of mqrt.dll
CCProjectZeroMembers
|
|
|
|
866 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Microsoft Office PowerPoint 2010 Invalid Pointer Reference
CCProjectZeroMembers
|
|
|
|
949 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
MSO!Ordinal5429 heap corruption due to missing length check
CCProjectZeroMembers
|
|
|
|
950 |
----
|
Fixed
|
----
|
----
|
scvitti@google.com
|
Office Powerpoint 2010 MSO/OART heap out of bounds access
CCProjectZeroMembers
|
|