Multiple vulnerabilities in Microsoft Office

Description

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information and gain privileges.

Below is a complete list of vulnerabilities:

1. Multiple vulnerabilities related to an improper handling of objects in memory in Microsoft Office can be exploited locally via a specially designed file to execute arbitrary code;
2. An incorrect handling of objects in memory in Microsoft Graphics Component can be exploited remotely via a specially designed website to execute arbitrary code;
3. An improper handling of embedded fonts in Win32k Graphics can be exploited remotely via a specially designed website to execute arbitrary code;
4. Multiple vulnerabilities related to an incorrect handling of web requests in Microsoft SharePoint can be exploited remotely by sending a specially designed request to an affected server to gain privileges;
5. An improper handing of objects in memory in Windows Graphics Device Interface (GDI) can be exploited locally by running a specially designed application on affected system to obtain sensitive information;
6. An improper disclosure of content in memory in Windows Uniscribe can be exploited to obtain sensitive information.

---

Technical details

NB: Not every vulnerability already has CVSS rating, so cumulative CVSS rating can be not representative.

Original advisories

• ADV170015

• CVE-2017-8567
• CVE-2017-8632
• CVE-2017-8630
• CVE-2017-8631
• CVE-2017-8682
• CVE-2017-8744
• CVE-2017-8745
• CVE-2017-8742
• CVE-2017-8695
• CVE-2017-8696
• CVE-2017-8629
• CVE-2017-8725
• CVE-2017-8676
• CVE-2017-8743
• CVE-2017-8676
• CVE-2017-8682
• CVE-2017-8695
• CVE-2017-8696
• CVE-2017-8745
• CVE-2017-8744
• CVE-2017-8743
• CVE-2017-8742
• CVE-2017-8725
• CVE-2017-8632
• CVE-2017-8631
• CVE-2017-8630
• CVE-2017-8629
• CVE-2017-8567

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

• Microsoft-Office-Live-Meeting-2007
• Microsoft-Lync
• Microsoft-Office-PowerPoint
• Microsoft-Office
• Microsoft-Outlook
• Microsoft-Excel
• Microsoft-Word
• Microsoft-Sharepoint-Server

CVE list

• CVE-2017-8676
  warning
• CVE-2017-8682
  critical
• CVE-2017-8695
  warning
• CVE-2017-8696
  critical
• CVE-2017-8745
  warning
• CVE-2017-8744
  critical
• CVE-2017-8743
  critical
• CVE-2017-8742
  critical
• CVE-2017-8725
  critical
• CVE-2017-8632
  critical
• CVE-2017-8631
  critical
• CVE-2017-8630
  critical
• CVE-2017-8629
  warning
• CVE-2017-8567
  critical

KB list

• 3213649
• 3213644
• 3213646
• 3213641
• 3213642
• 3213560
• 4025867
• 3213562
• 3213564
• 3191831
• 4011117
• 3128030
• 4025868
• 3213631
• 4025865
• 4025866
• 4011113
• 3213638
• 4011069
• 3141537
• 4011041
• 4011040
• 4011065
• 4011064
• 4011089
• 4011062
• 4011061
• 4011134
• 3213658
• 3213626
• 3203474
• 3213551
• 3212225
• 4011056
• 4011055
• 4011050
• 4011038
• 4011063
• 4011107
• 3128027
• 4025869
• 4011090
• 4011091
• 3114428
• 4011103
• 4011126
• 4011127
• 3213632
• 4011108
• 4011125
• 4011110

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com