CVE-2006-3650

Microsoft Office 2000, XP, 2003, 2004 for Mac, and v.X for Mac do not properly parse the length of a chart record, which allows remote user-assisted attackers to execute arbitrary code via a Word document with an embedded malformed chart record that triggers an overwrite of pointer values with values from the document, a different vulnerability than CVE-2006-3434, CVE-2006-3864, and CVE-2006-3868.

Date published : 2006-10-10

http://www.securityfocus.com/bid/20383

http://www.securityfocus.com/archive/1/448151/100/0/threaded