Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions and privilege escalations.

Below is a complete list of vulnerabilities:

1. Multiple vulnerabilities related to an incorrect handing of objects in memory in Microsoft Office can be exploited remotely via sending a specially designed document to affected system to execute arbitrary code;
2. An improper user sessions management in Microsoft Project Server can be exploited remotely via a specially designed website to gain privileges;
3. An incorrect process of processing macros settings in Excel document can be exploited remotely to bypass security restrictions;

Technical details

Vulnerability (1) requires that a user open a file with an affected version of Microsoft Office.

Microsoft Word 2016 for Mac
Microsoft Excel  2016 Click-to-Run (C2R) for 32-bit editions
Microsoft Excel  2016 Click-to-Run (C2R) for 64-bit editions
Microsoft Excel 2007 Service Pack 3
Microsoft Excel 2010 Service Pack 2 (32-bit editions)
Microsoft Excel 2010 Service Pack 2 (64-bit editions)
Microsoft Excel 2013 RT Service Pack 1
Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft Excel 2013 Service Pack 1 (64-bit editions)
Microsoft Excel 2016 (32-bit edition)
Microsoft Excel 2016 (64-bit edition)
Microsoft Excel 2016 for Mac
Microsoft Excel Viewer 2007 Service Pack 3
Microsoft Office 2007 Service Pack 3
Microsoft Office 2010 Service Pack 2 (32-bit editions)
Microsoft Office 2010 Service Pack 2 (64-bit editions)
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2016 (32-bit edition)
Microsoft Office 2016 (64-bit edition)
Microsoft Office Compatibility Pack Service Pack 3
Microsoft Office Web Apps 2010 Service Pack 2
Microsoft Office Web Apps Server 2013 Service Pack 1
Microsoft Office Word Viewer
Microsoft Project Server 2013 Service Pack 1
Microsoft SharePoint Enterprise Server 2016
Microsoft Word 2007 Service Pack 3
Microsoft Word 2010 Service Pack 2 (32-bit editions)
Microsoft Word 2010 Service Pack 2 (64-bit editions)
Microsoft Word 2013 RT Service Pack 1
Microsoft Word 2013 Service Pack 1 (32-bit editions)
Microsoft Word 2013 Service Pack 1 (64-bit editions)
Microsoft Word 2016 (32-bit edition)
Microsoft Word 2016 (64-bit edition)

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

ADV170020
CVE-2017-11854
CVE-2017-11876
CVE-2017-11877
CVE-2017-11878
CVE-2017-11882
CVE-2017-11884

4011242
4011247
4011268
4011245
4011244
4011265
4011264
4011267
4011266
4011262
4011206
4011205
4011220
3162047
4011233
4011250
4011199
4011257
4011270
4011271
4011197
4011618
4011020
4011604