Kaspersky Threats

Detect date

?

04/14/2020

Severity

?

Critical

Description

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, spoof user interface.

Below is a complete list of vulnerabilities:

An elevation of privilege vulnerability in Microsoft (MAU) Office can be exploited remotely to gain privileges.
A remote code execution vulnerability in Microsoft Word can be exploited remotely via specially crafted file to execute arbitrary code.
A remote code execution vulnerability in Microsoft Office Access Connectivity Engine can be exploited remotely via specially crafted file to execute arbitrary code.
A cross-site-scripting (XSS) vulnerability Microsoft Office SharePoint can be exploited remotely via specially crafted web to spoof user interface.
A remote code execution vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted to execute arbitrary code.
A remote code execution vulnerability in Microsoft Excel can be exploited remotely via specially crafted file to execute arbitrary code.
A remote code execution vulnerability in Microsoft Office can be exploited remotely via specially crafted to execute arbitrary code.
A remote code execution vulnerability in Microsoft Office can be exploited remotely via specially crafted file to execute arbitrary code.
A spoofing vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted web to spoof user interface.
An elevation of privilege vulnerability in OneDrive for Windows can be exploited remotely via specially crafted application to gain privileges.

Affected products

Microsoft PowerPoint 2013 RT Service Pack 1
Microsoft Publisher 2010 Service Pack 2 (64-bit editions)
Microsoft Office 2019 for Mac
Microsoft PowerPoint 2010 Service Pack 2 (32-bit editions)
Microsoft Publisher 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2010 Service Pack 2 (32-bit editions)
Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft Word 2010 Service Pack 2 (64-bit editions)
Microsoft Access 2016 (32-bit edition)
Office 365 ProPlus for 64-bit Systems
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft Word 2016 (32-bit edition)
Microsoft Office 2016 (64-bit edition)
Microsoft Business Productivity Servers 2010 Service Pack 2
Microsoft Office 2013 RT Service Pack 1
Microsoft Outlook 2016 (32-bit edition)
Microsoft Outlook 2013 RT Service Pack 1
Microsoft Access 2010 Service Pack 2 (64-bit editions)
Microsoft Access 2013 Service Pack 1 (32-bit editions)
Microsoft Office Web Apps 2010 Service Pack 2
Microsoft Word 2010 Service Pack 2 (32-bit editions)
Microsoft Project 2013 Service Pack 1 (32-bit editions)
Microsoft Publisher 2013 Service Pack 1 (32-bit editions)
Office 365 ProPlus for 32-bit Systems
Microsoft Office 2010 Service Pack 2 (64-bit editions)
Microsoft Excel 2016 (32-bit edition)
Microsoft Office Web Apps 2013 Service Pack 1
Microsoft Excel 2013 Service Pack 1 (64-bit editions)
Microsoft PowerPoint 2016 (64-bit edition)
Microsoft PowerPoint 2016 (32-bit edition)
Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft Visio 2010 Service Pack 2 (64-bit editions)
Microsoft Office 2019 for 32-bit editions
Microsoft Outlook 2013 Service Pack 1 (64-bit editions)
Microsoft Project 2010 Service Pack 2 (64-bit editions)
Microsoft PowerPoint 2013 Service Pack 1 (64-bit editions)
Microsoft Publisher 2010 Service Pack 2 (32-bit editions)
Microsoft Word 2013 RT Service Pack 1
Microsoft Office 2016 for Mac
Microsoft Excel 2013 RT Service Pack 1
Microsoft Office 2016 (32-bit edition)
Microsoft SharePoint Server 2010 Service Pack 2
Microsoft Publisher 2016 (64-bit edition)
Microsoft Outlook 2010 Service Pack 2 (64-bit editions)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft PowerPoint 2010 Service Pack 2 (64-bit editions)
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft Project 2013 Service Pack 1 (64-bit editions)
Microsoft AutoUpdate for Mac
Microsoft SharePoint Enterprise Server 2016
Microsoft Excel 2010 Service Pack 2 (32-bit editions)
Microsoft Visio 2016 (32-bit edition)
Microsoft Access 2013 Service Pack 1 (64-bit editions)
Microsoft SharePoint Server 2019
OneDrive for Windows
Microsoft Outlook 2010 Service Pack 2 (32-bit editions)
Microsoft Word 2013 Service Pack 1 (32-bit editions)
Microsoft Word 2013 Service Pack 1 (64-bit editions)
Microsoft PowerPoint 2013 Service Pack 1 (32-bit editions)
Microsoft Project 2010 Service Pack 2 (32-bit editions)
Microsoft Excel 2016 (64-bit edition)
Microsoft SharePoint Foundation 2010 Service Pack 2
Microsoft Project Server 2013 Service Pack 1 (64-bit edition)
Microsoft Access 2016 (64-bit edition)
Microsoft Outlook 2016 (64-bit edition)
Microsoft Outlook 2013 Service Pack 1 (32-bit editions)
Microsoft Word 2016 (64-bit edition)
Microsoft Excel 2010 Service Pack 2 (64-bit editions)
Microsoft Publisher 2016 (32-bit edition)
Microsoft Project 2016 (32-bit edition)
Microsoft Access 2010 Service Pack 2 (32-bit editions)
Microsoft Office 2019 for 64-bit editions
Microsoft Visio 2016 (64-bit edition)
Microsoft Visio 2013 Service Pack 1 (32-bit editions)
Microsoft Visio 2010 Service Pack 2 (32-bit editions)
Microsoft Visio 2013 Service Pack 1 (64-bit editions)
Microsoft Project 2016 (64-bit edition)
Microsoft Office Online Server

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories

CVE-2020-0984
CVE-2020-0980
CVE-2020-0961
CVE-2020-0924
CVE-2020-0925
CVE-2020-0926
CVE-2020-0927
CVE-2020-0920
CVE-2020-0923
CVE-2020-0906
CVE-2020-0929
CVE-2020-0760
CVE-2020-0991
CVE-2020-0979
CVE-2020-0978
CVE-2020-0977
CVE-2020-0976
CVE-2020-0975
CVE-2020-0974
CVE-2020-0973
CVE-2020-0972
CVE-2020-0971
CVE-2020-0954
CVE-2020-0933
CVE-2020-0932
CVE-2020-0931
CVE-2020-0930
CVE-2020-0935

Impacts

?

ACE

[?]

PE

[?]

SUI

[?]

Detect date ?	04/14/2020
Severity ?	Critical
Description	Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, spoof user interface. Below is a complete list of vulnerabilities: An elevation of privilege vulnerability in Microsoft (MAU) Office can be exploited remotely to gain privileges. A remote code execution vulnerability in Microsoft Word can be exploited remotely via specially crafted file to execute arbitrary code. A remote code execution vulnerability in Microsoft Office Access Connectivity Engine can be exploited remotely via specially crafted file to execute arbitrary code. A cross-site-scripting (XSS) vulnerability Microsoft Office SharePoint can be exploited remotely via specially crafted web to spoof user interface. A remote code execution vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted to execute arbitrary code. A remote code execution vulnerability in Microsoft Excel can be exploited remotely via specially crafted file to execute arbitrary code. A remote code execution vulnerability in Microsoft Office can be exploited remotely via specially crafted to execute arbitrary code. A remote code execution vulnerability in Microsoft Office can be exploited remotely via specially crafted file to execute arbitrary code. A spoofing vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted web to spoof user interface. An elevation of privilege vulnerability in OneDrive for Windows can be exploited remotely via specially crafted application to gain privileges.
Affected products	Microsoft PowerPoint 2013 RT Service Pack 1 Microsoft Publisher 2010 Service Pack 2 (64-bit editions) Microsoft Office 2019 for Mac Microsoft PowerPoint 2010 Service Pack 2 (32-bit editions) Microsoft Publisher 2013 Service Pack 1 (64-bit editions) Microsoft Office 2010 Service Pack 2 (32-bit editions) Microsoft Excel 2013 Service Pack 1 (32-bit editions) Microsoft Word 2010 Service Pack 2 (64-bit editions) Microsoft Access 2016 (32-bit edition) Office 365 ProPlus for 64-bit Systems Microsoft SharePoint Foundation 2013 Service Pack 1 Microsoft Word 2016 (32-bit edition) Microsoft Office 2016 (64-bit edition) Microsoft Business Productivity Servers 2010 Service Pack 2 Microsoft Office 2013 RT Service Pack 1 Microsoft Outlook 2016 (32-bit edition) Microsoft Outlook 2013 RT Service Pack 1 Microsoft Access 2010 Service Pack 2 (64-bit editions) Microsoft Access 2013 Service Pack 1 (32-bit editions) Microsoft Office Web Apps 2010 Service Pack 2 Microsoft Word 2010 Service Pack 2 (32-bit editions) Microsoft Project 2013 Service Pack 1 (32-bit editions) Microsoft Publisher 2013 Service Pack 1 (32-bit editions) Office 365 ProPlus for 32-bit Systems Microsoft Office 2010 Service Pack 2 (64-bit editions) Microsoft Excel 2016 (32-bit edition) Microsoft Office Web Apps 2013 Service Pack 1 Microsoft Excel 2013 Service Pack 1 (64-bit editions) Microsoft PowerPoint 2016 (64-bit edition) Microsoft PowerPoint 2016 (32-bit edition) Microsoft SharePoint Enterprise Server 2013 Service Pack 1 Microsoft Visio 2010 Service Pack 2 (64-bit editions) Microsoft Office 2019 for 32-bit editions Microsoft Outlook 2013 Service Pack 1 (64-bit editions) Microsoft Project 2010 Service Pack 2 (64-bit editions) Microsoft PowerPoint 2013 Service Pack 1 (64-bit editions) Microsoft Publisher 2010 Service Pack 2 (32-bit editions) Microsoft Word 2013 RT Service Pack 1 Microsoft Office 2016 for Mac Microsoft Excel 2013 RT Service Pack 1 Microsoft Office 2016 (32-bit edition) Microsoft SharePoint Server 2010 Service Pack 2 Microsoft Publisher 2016 (64-bit edition) Microsoft Outlook 2010 Service Pack 2 (64-bit editions) Microsoft Office 2013 Service Pack 1 (64-bit editions) Microsoft PowerPoint 2010 Service Pack 2 (64-bit editions) Microsoft Office 2013 Service Pack 1 (32-bit editions) Microsoft Project 2013 Service Pack 1 (64-bit editions) Microsoft AutoUpdate for Mac Microsoft SharePoint Enterprise Server 2016 Microsoft Excel 2010 Service Pack 2 (32-bit editions) Microsoft Visio 2016 (32-bit edition) Microsoft Access 2013 Service Pack 1 (64-bit editions) Microsoft SharePoint Server 2019 OneDrive for Windows Microsoft Outlook 2010 Service Pack 2 (32-bit editions) Microsoft Word 2013 Service Pack 1 (32-bit editions) Microsoft Word 2013 Service Pack 1 (64-bit editions) Microsoft PowerPoint 2013 Service Pack 1 (32-bit editions) Microsoft Project 2010 Service Pack 2 (32-bit editions) Microsoft Excel 2016 (64-bit edition) Microsoft SharePoint Foundation 2010 Service Pack 2 Microsoft Project Server 2013 Service Pack 1 (64-bit edition) Microsoft Access 2016 (64-bit edition) Microsoft Outlook 2016 (64-bit edition) Microsoft Outlook 2013 Service Pack 1 (32-bit editions) Microsoft Word 2016 (64-bit edition) Microsoft Excel 2010 Service Pack 2 (64-bit editions) Microsoft Publisher 2016 (32-bit edition) Microsoft Project 2016 (32-bit edition) Microsoft Access 2010 Service Pack 2 (32-bit editions) Microsoft Office 2019 for 64-bit editions Microsoft Visio 2016 (64-bit edition) Microsoft Visio 2013 Service Pack 1 (32-bit editions) Microsoft Visio 2010 Service Pack 2 (32-bit editions) Microsoft Visio 2013 Service Pack 1 (64-bit editions) Microsoft Project 2016 (64-bit edition) Microsoft Office Online Server
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories	CVE-2020-0984 CVE-2020-0980 CVE-2020-0961 CVE-2020-0924 CVE-2020-0925 CVE-2020-0926 CVE-2020-0927 CVE-2020-0920 CVE-2020-0923 CVE-2020-0906 CVE-2020-0929 CVE-2020-0760 CVE-2020-0991 CVE-2020-0979 CVE-2020-0978 CVE-2020-0977 CVE-2020-0976 CVE-2020-0975 CVE-2020-0974 CVE-2020-0973 CVE-2020-0972 CVE-2020-0971 CVE-2020-0954 CVE-2020-0933 CVE-2020-0932 CVE-2020-0931 CVE-2020-0930 CVE-2020-0935
Impacts ?	ACE [?] PE [?] SUI [?]
Related products	Microsoft Access Microsoft Visio 2010 Microsoft Office Microsoft Outlook Microsoft Excel Microsoft Word Microsoft Windows
CVE-IDS ?	CVE-2020-09840.0Unknown CVE-2020-09800.0Unknown CVE-2020-09610.0Unknown CVE-2020-09240.0Unknown CVE-2020-09250.0Unknown CVE-2020-09260.0Unknown CVE-2020-09270.0Unknown CVE-2020-09200.0Unknown CVE-2020-09230.0Unknown CVE-2020-09060.0Unknown CVE-2020-09290.0Unknown CVE-2020-07600.0Unknown CVE-2020-09910.0Unknown CVE-2020-09790.0Unknown CVE-2020-09780.0Unknown CVE-2020-09770.0Unknown CVE-2020-09760.0Unknown CVE-2020-09750.0Unknown CVE-2020-09740.0Unknown CVE-2020-09730.0Unknown CVE-2020-09720.0Unknown CVE-2020-09710.0Unknown CVE-2020-09540.0Unknown CVE-2020-09330.0Unknown CVE-2020-09320.0Unknown CVE-2020-09310.0Unknown CVE-2020-09300.0Unknown CVE-2020-09350.0Unknown
KB list	3203462 4484258 4475609 3162033 4011584 4484293 4484285 4484214 4484281 4484260 2553306 4484244 4484300 4484269 4484319 4484283 4484126 4032216 4484292 4484273 4484307 4484274 3128012 4484226 4464544 4462153 4484322 4484295 4484125 4484238 4484291 4484296 4484301 4484308 4484294 4484298 4484246 4484287 4484229 4011104 4462210 4484297 4484117 4484235 4484167 4484266 4462225 4484132 4011097 4484299 4464527 4484290 4011581 4484284 4484321
Microsoft official advisories	Microsoft Security Update Guide