KLA11864
Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, obtain sensitive information, perform cross-site scripting attack, gain privileges.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in Microsoft Word can be exploited remotely via special crafted file to execute arbitrary code.
2. A remote code execution vulnerability in Microsoft Project can be exploited remotely via specially crafted file to execute arbitrary code.
3. A remote code execution vulnerability in .NET Framework, SharePoint Server, and Visual Studio can be exploited remotely via specially crafted document to execute arbitrary code.
4. A cross-site-scripting (XSS) vulnerability Microsoft SharePoint Reflective can be exploited remotely via specially crafted request to spoof user interface.
5. A remote code execution vulnerability in Microsoft Office can be exploited remotely via specially crafted to execute arbitrary code.
6. A cross-site-scripting (XSS) vulnerability Microsoft Office SharePoint can be exploited remotely via specially crafted web to spoof user interface.
7. A cross-site-scripting (XSS) vulnerability in Office Web Apps can be exploited remotely via specially crafted request to spoof user interface.
8. A spoofing vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted web to spoof user interface.
9. A remote code execution vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted email to execute arbitrary code.
10. An information disclosure vulnerability in Microsoft Office can be exploited to obtain sensitive information.
11. A remote code execution vulnerability in Microsoft Word can be exploited remotely via specially crafted file to execute arbitrary code.
12. A remote code execution vulnerability in PerformancePoint Services can be exploited remotely via specially crafted document to execute arbitrary code.
13. A cross-site-scripting (XSS) vulnerability in Microsoft SharePoint Server can be exploited remotely via special crafted web to spoof user interface.
14. A remote code execution vulnerability in Microsoft Outlook can be exploited to execute arbitrary code.
15. An elevation of privilege vulnerability in Microsoft OneDrive can be exploited remotely via specially crafted application to gain privileges.
16. A cross-site-scripting (XSS) vulnerability in Microsoft Office SharePoint can be exploited remotely via specially crafted web to spoof user interface.
17. An information disclosure vulnerability in Microsoft Office can be exploited remotely via specially crafted file to obtain sensitive information.
18. A remote code execution vulnerability in DirectWrite can be exploited remotely via specially crafted document to execute arbitrary code.
19. A remote code execution vulnerability in Microsoft Excel can be exploited remotely via specially crafted file to execute arbitrary code.
20. An elevation of privilege vulnerability in Microsoft Office can be exploited remotely to gain privileges.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

.NET Core 2.1
Microsoft Office Web Apps 2010 Service Pack 2
Microsoft Word 2013 Service Pack 1 (64-bit editions)
Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2
Microsoft .NET Framework 4.5.2
Microsoft Office 2019 for Mac
Microsoft Word 2010 Service Pack 2 (32-bit editions)
Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft Word 2016 (32-bit edition)
Microsoft .NET Framework 3.5 AND 4.6/4.6.1/4.6.2
Microsoft SharePoint Enterprise Server 2016
Microsoft .NET Framework 4.6
Microsoft .NET Framework 3.5 AND 4.8
Microsoft .NET Framework 3.5 AND 4.7.2
Microsoft Project 2013 Service Pack 1 (32-bit editions)
Microsoft SharePoint Server 2019
Microsoft Project 2016 (32-bit edition)
Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2
Microsoft Word 2016 (64-bit edition)
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft Project 2010 Service Pack 2 (32-bit editions)
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft .NET Framework 3.5
OneDrive for Windows
Microsoft Office 2010 Service Pack 2 (32-bit editions)
Microsoft Word 2010 Service Pack 2 (64-bit editions)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft Office 2019 for 64-bit editions
Microsoft Office Online Server
Microsoft Lync Server 2013
Skype for Business Server 2019 CU2
Skype for Business Server 2015 CU 8
Microsoft SharePoint Server 2010 Service Pack 2
Microsoft Office 2010 Service Pack 2 (64-bit editions)
Microsoft .NET Framework 3.5 AND 4.7.1/4.7.2
Microsoft Word 2013 Service Pack 1 (32-bit editions)
Microsoft Project 2010 Service Pack 2 (64-bit editions)
Microsoft Project 2016 (64-bit edition)
.NET Core 3.1
Microsoft Office 2016 for Mac
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft Office 2019 for 32-bit editions
Microsoft .NET Framework 3.5.1
Microsoft Word 2013 RT Service Pack 1
Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft .NET Framework 4.8
Microsoft Office Web Apps 2013 Service Pack 1
Microsoft Project 2013 Service Pack 1 (64-bit editions)

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

CVE-2020-1448
CVE-2020-1449
CVE-2020-1147
CVE-2020-1454
CVE-2020-1458
CVE-2020-1456
CVE-2020-1442
CVE-2020-1443
CVE-2020-1444
CVE-2020-1445
CVE-2020-1446
CVE-2020-1447
CVE-2020-1439
CVE-2020-1451
CVE-2020-1349
CVE-2020-1465
CVE-2020-1450
CVE-2020-1342
CVE-2020-1409
CVE-2020-1240
CVE-2020-1025

4484443
4484441
4484440
4484446
4484357
4484370
4484448
4484353
4484374
4484463
4484460
4484363
4484450
4484451
4484452
4484453
4484348
4484433
4484456
4484458
4484438
4484436
4484381
4484382
4484411
4571332
4571333
4571334