Multiple vulnerabilities in Microsoft Office

Description

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, bypass security restrictions and gain privileges.

Below is a complete list of vulnerabilities:

1. An incorrect handling of objects in memory in Microsoft Excel can be exploited locally via a specially designed document to execute arbitrary code;
2. An improper web-requests sanitization in Microsoft SharePoint Server can be be exploited remotely via a specially designed request to gain privileges;
3. An improper attachment handling in Microsoft Outlook can be exploited remotely via a specially designed document to bypass security restrictions;
4. Multiple memory corruption vulnerabilities in Microsoft Office software can be exploited locally via a specially designed document to execute arbitrary code;
5. An incorrect embedded URL’s processing in Microsoft Outlook can be exploited remotely via a specially designed e-mail to obtain sensitive information;
6. An incorrect handling of objects in memory in Microsoft Excel can be exploited remotely via a specially designed document to obtain sensitive information;
7. An improper handling of objects in memory in Microsoft InfoPath can be exploited locally via a specially crafted document to execute arbitrary code.

Original advisories

• CVE-2018-8147

• CVE-2018-8148
• CVE-2018-8149
• CVE-2018-8150
• CVE-2018-8155
• CVE-2018-8156
• CVE-2018-8157
• CVE-2018-8158
• CVE-2018-8160
• CVE-2018-8161
• CVE-2018-8162
• CVE-2018-8163
• CVE-2018-8168
• CVE-2018-8173

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

• Microsoft-Office
• Microsoft-Excel
• Microsoft-Word
• Microsoft-Sharepoint-Server

CVE list

• CVE-2018-8147
  critical
• CVE-2018-8148
  critical
• CVE-2018-8149
  warning
• CVE-2018-8150
  warning
• CVE-2018-8155
  warning
• CVE-2018-8156
  warning
• CVE-2018-8157
  critical
• CVE-2018-8158
  critical
• CVE-2018-8160
  warning
• CVE-2018-8161
  critical
• CVE-2018-8162
  critical
• CVE-2018-8163
  warning
• CVE-2018-8168
  warning
• CVE-2018-8173
  critical

KB list

• 2899590
• 3114889
• 3162075
• 3172436
• 4018308
• 4018327
• 4018381
• 4018382
• 4018383
• 4018388
• 4018390
• 4018393
• 4018396
• 4018398
• 4018399
• 4022130
• 4022135
• 4022137
• 4022139
• 4022141
• 4022142
• 4022145
• 4022146
• 4022150

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com