KLA10716
Code execution vulnerabilities in Microsoft Office
Updated: 06/01/2019
Detect date
?
12/08/2015
Severity
?
High
Description

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code.

Below is a complete list of vulnerabilities:

  1. Improper memory handling can be exploited remotely via a specially designed content to execute arbitrary code;
  2. Improper emails parsing can be exploited remotely via a specially designed email message to execute arbitrary code.

Technical details

Vulnerability (2) can be triggered on stations with Outlook installed. To mitigate this vulnerability you can disable messages preview and disable HTML display in Outlook.

Affected products

Microsoft Office 2007 Service Pack 3
Microsoft Office 2010 Service Pack 2
Microsoft Office 2013 Service Pack 1
Microsoft Office 2016
Microsoft Office 2013 RT Service Pack 1
Microsoft Office for Mac 2011
Microsoft Office for Mac 2016

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories

CVE-2015-6122
CVE-2015-6118
CVE-2015-6177
CVE-2015-6124
CVE-2015-6172
CVE-2015-6040

Impacts
?
ACE 
[?]
Related products
Microsoft Office
CVE-IDS
?
CVE-2015-61229.3Critical
CVE-2015-61189.3Critical
CVE-2015-61779.3Critical
CVE-2015-61249.3Critical
CVE-2015-61729.3Critical
CVE-2015-60409.3Critical
Microsoft official advisories
Microsoft Security Update Guide
KB list

3085549
3114422
3114479
3114431
3114425
3114433
3114382
3114415
3114342
3114403
3119518
3085528
3116111
3114457
3101532
3114458
3119517