Kaspersky Threats

Detect date

?

11/10/2015

Severity

?

High

Description

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to spoof user interface, gain privileges or execute arbitrary code.

Below is a complete list of vulnerabilities

Improper memory objects handling can be exploited remotely via a specially designed file or web content to execute arbitrary code;
AN unknown vulnerability can be exploited via a specially designed web content to gain privileges or execute arbitrary code from vectors related to Internet Explorer;
Lack of HTML sanitization at Outlook can be exploited remotely via a specially designed content to spoof user interface. (OS X)

Affected products

Microsoft Office 2007 Service Pack 3
Microsoft Office 2010 Service Pack 2
Microsoft Pinyin IME 2010
Microsoft Office 2013 Service Pack 1
Microsoft Office 2013 RT Service Pack 1
Microsoft Office 2016
Microsoft Excel 2011 for Mac
Microsoft Excel 2016 for Mac
Microsoft Office Compatibility Pack Service Pack 3
Microsoft Excel Viewer
Microsoft Word Viewer
Microsoft SharePoint Server 2007 Service Pack 3
Microsoft SharePoint Server 2010 Service Pack 2
Microsoft SharePoint Server 2013 Service Pack 1
Microsoft Office Web Apps 2010 Service Pack 2
Microsoft Office Web Apps Server 2013 Service Pack 1
Skype for Business 2016
Microsoft Lync 2013 Service Pack 1

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories

CVE-2015-6091
CVE-2015-6092
CVE-2015-6093
CVE-2015-6094
CVE-2015-6038
CVE-2015-2503
CVE-2015-6123

Impacts

?

ACE

[?]

PE

[?]

SUI

[?]

Detect date ?	11/10/2015
Severity ?	High
Description	Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to spoof user interface, gain privileges or execute arbitrary code. Below is a complete list of vulnerabilities Improper memory objects handling can be exploited remotely via a specially designed file or web content to execute arbitrary code; AN unknown vulnerability can be exploited via a specially designed web content to gain privileges or execute arbitrary code from vectors related to Internet Explorer; Lack of HTML sanitization at Outlook can be exploited remotely via a specially designed content to spoof user interface. (OS X)
Affected products	Microsoft Office 2007 Service Pack 3 Microsoft Office 2010 Service Pack 2 Microsoft Pinyin IME 2010 Microsoft Office 2013 Service Pack 1 Microsoft Office 2013 RT Service Pack 1 Microsoft Office 2016 Microsoft Excel 2011 for Mac Microsoft Excel 2016 for Mac Microsoft Office Compatibility Pack Service Pack 3 Microsoft Excel Viewer Microsoft Word Viewer Microsoft SharePoint Server 2007 Service Pack 3 Microsoft SharePoint Server 2010 Service Pack 2 Microsoft SharePoint Server 2013 Service Pack 1 Microsoft Office Web Apps 2010 Service Pack 2 Microsoft Office Web Apps Server 2013 Service Pack 1 Skype for Business 2016 Microsoft Lync 2013 Service Pack 1
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories	CVE-2015-6091 CVE-2015-6092 CVE-2015-6093 CVE-2015-6094 CVE-2015-6038 CVE-2015-2503 CVE-2015-6123
Impacts ?	ACE [?] PE [?] SUI [?]
Related products	Microsoft Office
CVE-IDS ?	CVE-2015-60919.3Critical CVE-2015-60929.3Critical CVE-2015-60939.3Critical CVE-2015-60949.3Critical CVE-2015-60389.3Critical CVE-2015-25039.3Critical CVE-2015-61234.3Warning
Microsoft official advisories	Microsoft Security Update Guide
KB list	3085634 3101496 3101559 3101514 2899516 3101510 3101513 3101512 3085614 3085594 2687406 3101555 3101554 3101367 3101364 3101365 3101360 3102925 3054793 3102924 2889915 3101507 3085511 3085552 3085551 2910978 3085477 2920680 2920726 3101529 3101543 3101525 3101526 3101553 3101506 2880506 3101359 3101564 3101499 3104540 2965313 3101558 3101544 3101509 3054978 3101371 3101370 2920698 2878230 3085584 2596614 2596770 3085548 3101560 3085561 3101521 3101533 2899473 2817478
	Find out the statistics of the vulnerabilities spreading in your region

KLA10696Multiple vulnerabilities in Microsoft Office

KLA10696
Multiple vulnerabilities in Microsoft Office