Kaspersky Threats

Detect date

?

04/11/2017

Severity

?

Critical

Description

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to obtain sensitive information, gain privileges, bypass security restrictions and spoof user interface.

Below is a complete list of vulnerabilities:

An incorrect handling of objects in memory in certain functions can be exploited remotely by convincing a user to open a specially designed document file;
An improper sanitizing of web requests can be exploited remotely by sending an email message or hosting a website with a specially designed URL and convincing a user to open it to gain privileges;
An incorrect parsing of file formats can be exploited remotely by convincing a user to open a specially designed file to bypass security restrictions;
An improper sanitizing of HTML tags can be exploited remotely by sending an email message with specially disigned HTML tags to spoof user interface;
An improper parsing of email messages can be exploited remotely by convincing a user to open or preview a specially designed email message to execute arbitrary code.

Affected products

Microsoft Excel 2007 Service Pack 3
Microsoft Excel 2010 Service Pack 2
Microsoft Office Compatibility Pack Service Pack 2
Microsoft Outlook 2007 Service Pack 3
Microsoft Outlook 2010 Service Pack 2
Microsoft Outlook 2013 Service Pack 1
Microsoft Outlook 2016
Microsoft Outlook for Mac 2011

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories

CVE-2017-0207
CVE-2017-0195
CVE-2017-0204
CVE-2017-0194
CVE-2017-0106
CVE-2017-0194
CVE-2017-0195
CVE-2017-0207
CVE-2017-0204
CVE-2017-0106

Impacts

?

OSI

[?]

SB

[?]

PE

[?]

SUI

[?]

Detect date ?	04/11/2017
Severity ?	Critical
Description	Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to obtain sensitive information, gain privileges, bypass security restrictions and spoof user interface. Below is a complete list of vulnerabilities: An incorrect handling of objects in memory in certain functions can be exploited remotely by convincing a user to open a specially designed document file; An improper sanitizing of web requests can be exploited remotely by sending an email message or hosting a website with a specially designed URL and convincing a user to open it to gain privileges; An incorrect parsing of file formats can be exploited remotely by convincing a user to open a specially designed file to bypass security restrictions; An improper sanitizing of HTML tags can be exploited remotely by sending an email message with specially disigned HTML tags to spoof user interface; An improper parsing of email messages can be exploited remotely by convincing a user to open or preview a specially designed email message to execute arbitrary code.
Affected products	Microsoft Excel 2007 Service Pack 3 Microsoft Excel 2010 Service Pack 2 Microsoft Office Compatibility Pack Service Pack 2 Microsoft Outlook 2007 Service Pack 3 Microsoft Outlook 2010 Service Pack 2 Microsoft Outlook 2013 Service Pack 1 Microsoft Outlook 2016 Microsoft Outlook for Mac 2011
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories	CVE-2017-0207 CVE-2017-0195 CVE-2017-0204 CVE-2017-0194 CVE-2017-0106 CVE-2017-0194 CVE-2017-0195 CVE-2017-0207 CVE-2017-0204 CVE-2017-0106
Impacts ?	OSI [?] SB [?] PE [?] SUI [?]
Related products	Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Microsoft Office Microsoft Outlook Microsoft Excel
CVE-IDS ?	CVE-2017-01944.3Warning CVE-2017-01953.5Warning CVE-2017-02074.3Warning CVE-2017-02044.3Warning CVE-2017-01069.3Critical
Microsoft official advisories	Microsoft Security Update Guide
KB list	3212218 3191827 3191830 3191847 3101522 3127895 3178724 3178725 3191840 3191845 3118388 3127890 3172519 3178664
Exploitation	Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.
	Find out the statistics of the vulnerabilities spreading in your region

KLA11055Multiple vulnerabilities in Microsoft Office

KLA11055
Multiple vulnerabilities in Microsoft Office