Multiple vulnerabilities in Microsoft Office
| Risk | Critical |
| Patch available | YES |
| Number of vulnerabilities | 8 |
| CVE-ID | CVE-2015-2470 CVE-2015-2466 CVE-2015-2423 CVE-2015-2477 CVE-2015-2469 CVE-2015-2468 CVE-2015-2467 CVE-2015-1642 |
| CWE-ID | CWE-191 CWE-119 CWE-20 |
| Exploitation vector | Network |
| Public exploit |
Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #5 is available. Public exploit code for vulnerability #6 is available. Public exploit code for vulnerability #7 is available. Vulnerability #8 is being exploited in the wild. |
| Vulnerable software |
Microsoft Office Client/Desktop applications / Office applications Microsoft Office for Mac Client/Desktop applications / Office applications Microsoft Word Client/Desktop applications / Office applications Microsoft Visio Client/Desktop applications / Office applications Microsoft PowerPoint Client/Desktop applications / Office applications Microsoft Excel Client/Desktop applications / Office applications Microsoft Office Compatibility Pack Client/Desktop applications / Office applications Microsoft SharePoint Server Server applications / Application servers Word Automation Services on Microsoft SharePoint Server Server applications / Other server solutions |
| Vendor | Microsoft |
Security Bulletin
This security bulletin contains information about 8 vulnerabilities.
1) Integer underflow
EUVDB-ID: #VU5293
Risk: High
CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]
CVE-ID: CVE-2015-2470
CWE-ID:
CWE-191 - Integer underflow
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to integer underflow when processing Microsoft Office files. A remote attacker can trick the victim into opening a specially crafted Office file and execute arbitrary commands on the target system with privileges of the current user.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationInstall updates from Microsoft website.
Microsoft Office: 2007 - 2013
Microsoft Office for Mac: 2011
Microsoft Word: Viewer
CPE2.3- cpe:2.3:a:microsoft:microsoft_office:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_office_for_mac:2011:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_word:Viewer:*:*:*:*:microsoft_office:*:*
https://technet.microsoft.com/en-us/library/security/ms15-081.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website or open a file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
2) Memory corruption
EUVDB-ID: #VU5292
Risk: High
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2015-2466
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when processing Microsoft Office documents. A remote unauthenticated attacker can create a specially crafted Office document, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Install updates from Microsoft website.
Microsoft Office: 2007 - 2016
CPE2.3https://technet.microsoft.com/en-us/library/security/ms15-081.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website or open a file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Input validation error
EUVDB-ID: #VU5291
Risk: High
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2015-2423
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to input validation error when processing command line parameters in Microsoft Office files at a medium integrity level within Internet Explorer running in Enhanced Protection Mode (EPM). A remote attacker can trick the victim into opening a specially crafted Office file and execute arbitrary commands on the target system with privileges of the current user.
The vulnerability resides within Microsoft Windows, Internet Explorer, and Microsoft Office.
Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.
MitigationInstall updates from Microsoft website.
Microsoft Visio: 2007 - 2016
Microsoft Word: 2007 - 2016
Microsoft Office: 2010
Microsoft PowerPoint: 2007 - 2013
Microsoft Excel: 2007 - 2013
CPE2.3- cpe:2.3:a:microsoft:microsoft_visio:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_word:*:*:*:*:*:microsoft_office:*:*
- cpe:2.3:a:microsoft:microsoft_word:2013_RT_Service_Pack_1:*:*:*:*:microsoft_office:*:*
- cpe:2.3:a:microsoft:powerpoint:*:*:*:*:*:microsoft_office:*:*
- cpe:2.3:a:microsoft:microsoft_excel:*:*:*:*:*:microsoft_office:*:*
https://technet.microsoft.com/en-us/library/security/ms15-081.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website or open a file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Memory corruption
EUVDB-ID: #VU5290
Risk: High
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2015-2477
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when processing Microsoft Word documents. A remote unauthenticated attacker can create a specially crafted Word document, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Install updates from Microsoft website.
Microsoft Office: 2007
Microsoft Office for Mac: 2011 - 2016
Microsoft Word: Viewer
CPE2.3- cpe:2.3:a:microsoft:microsoft_office_for_mac:2011:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_office_for_mac:2016:*:*:*:*:*:*:*
https://technet.microsoft.com/en-us/library/security/ms15-081.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website or open a file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Memory corruption
EUVDB-ID: #VU5289
Risk: High
CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]
CVE-ID: CVE-2015-2469
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when processing Microsoft Office documents. A remote unauthenticated attacker can create a specially crafted Office document, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Install updates from Microsoft website.
Microsoft Word: 2007 - 2010
Microsoft Office: 2010
Microsoft Office for Mac: 2011
CPE2.3 External linkshttps://technet.microsoft.com/en-us/library/security/ms15-081.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website or open a file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
6) Memory corruption
EUVDB-ID: #VU5288
Risk: High
CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]
CVE-ID: CVE-2015-2468
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when processing Microsoft Office documents. A remote unauthenticated attacker can create a specially crafted Office document, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Mitigation
Install updates from Microsoft website.
Microsoft Word: 2007 - 2013
Microsoft Office: 2010
Microsoft Office for Mac: 2011 - 2016
Microsoft Office Compatibility Pack: Service Pack 3
Microsoft SharePoint Server: 2010 - 2013
Word Automation Services on Microsoft SharePoint Server: 2010 - 2013
CPE2.3- cpe:2.3:a:microsoft:microsoft_office_for_mac:2011:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_office_for_mac:2016:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_office_compatibility_pack:Service_Pack_3:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_sharepoint_server:2010:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_sharepoint_server:2013:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:word_automation_services_on_microsoft_sharepoint_server:2010:*:*:*:*:*:*:*
https://technet.microsoft.com/en-us/library/security/ms15-081.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website or open a file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
7) Memory corruption
EUVDB-ID: #VU5287
Risk: High
CVSSv4.0: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]
CVE-ID: CVE-2015-2467
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when processing Microsoft Office documents. A remote unauthenticated attacker can create a specially crafted Office document, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Install updates from Microsoft website.
Microsoft Office: 2007
CPE2.3https://technet.microsoft.com/en-us/library/security/ms15-081.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website or open a file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
8) Memory corruption
EUVDB-ID: #VU5285
Risk: Critical
CVSSv4.0: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Red]
CVE-ID: CVE-2015-1642
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to boundary error when processing Microsoft Office documents. A remote unauthenticated attacker can create a specially crafted Office document, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note: this vulnerability is being actively exploited.
MitigationInstall updates from Microsoft website.
Microsoft Office: 2007 - 2013
CPE2.3https://technet.microsoft.com/en-us/library/security/ms15-081.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website or open a file.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
