KLA11950
Multiple vulnerabilities in Microsoft Office

Updated: 09/21/2020
Detect date
?
09/08/2020
Severity
?
Critical
Description

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, obtain sensitive information, gain privileges.

Below is a complete list of vulnerabilities:

  1. A remote code execution vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted web request to execute arbitrary code.
  2. A cross-site-scripting (XSS) vulnerability Microsoft Office SharePoint can be exploited remotely via specially crafted web request to spoof user interface.
  3. An information disclosure vulnerability in Microsoft Excel can be exploited remotely to obtain sensitive information.
  4. A remote code execution vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted web request to execute arbitrary code.
  5. A remote code execution vulnerability in Microsoft SharePoint can be exploited remotely to execute arbitrary code.
  6. A spoofing vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted web request to spoof user interface.
  7. A cross-site-scripting (XSS) vulnerability Microsoft Office SharePoint can be exploited remotely via specially crafted web to spoof user interface.
  8. An elevation of privilege vulnerability in OneDrive for Windows can be exploited remotely via specially crafted application to gain privileges.
  9. A remote code execution vulnerability in Microsoft Excel can be exploited remotely via specially crafted file to execute arbitrary code.
  10. An information disclosure vulnerability in Microsoft Office can be exploited remotely via specially crafted file to obtain sensitive information.
  11. A remote code execution vulnerability in Microsoft Word can be exploited remotely via specially crafted file to execute arbitrary code.
  12. A tampering vulnerability in Microsoft SharePoint Server can be exploited remotely to spoof user interface.
  13. A remote code execution vulnerability in Microsoft SharePoint Server can be exploited remotely via specially crafted page to execute arbitrary code.
Affected products

Microsoft Office 2019 for 64-bit editions
Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft Office 2010 Service Pack 2 (64-bit editions)
Microsoft Word 2013 Service Pack 1 (32-bit editions)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft Excel 2013 Service Pack 1 (64-bit editions)
Microsoft Excel 2016 (32-bit edition)
Microsoft Office 2016 for Mac
Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft Office Web Apps 2013 Service Pack 1
Microsoft Office 2013 RT Service Pack 1
Microsoft Excel 2013 RT Service Pack 1
Microsoft SharePoint Server 2010 Service Pack 2
Microsoft Word 2010 Service Pack 2 (32-bit editions)
Microsoft Office 2019 for 32-bit editions
Microsoft Office 2016 (32-bit edition)
Microsoft Office 2016 (64-bit edition)
Microsoft Office 2019 for Mac
Microsoft Office Online Server
Microsoft Word 2013 RT Service Pack 1
Microsoft Word 2010 Service Pack 2 (64-bit editions)
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Foundation 2010 Service Pack 2
Microsoft SharePoint Foundation 2013 Service Pack 1
OneDrive for Windows
Microsoft Excel 2010 Service Pack 2 (32-bit editions)
Microsoft Word 2016 (64-bit edition)
Microsoft Excel 2010 Service Pack 2 (64-bit editions)
Microsoft Office 2010 Service Pack 2 (32-bit editions)
Microsoft Business Productivity Servers 2010 Service Pack 2
Microsoft SharePoint Server 2019
Microsoft Word 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft Excel 2016 (64-bit edition)
Microsoft Word 2016 (32-bit edition)
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft Office Web Apps 2010 Service Pack 2

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories

CVE-2020-1452
CVE-2020-1345
CVE-2020-1224
CVE-2020-1227
CVE-2020-1200
CVE-2020-1595
CVE-2020-1205
CVE-2020-1453
CVE-2020-1575
CVE-2020-1576
CVE-2020-16851
CVE-2020-1193
CVE-2020-16852
CVE-2020-1514
CVE-2020-1594
CVE-2020-16855
CVE-2020-1198
CVE-2020-1482
CVE-2020-16853
CVE-2020-1210
CVE-2020-1338
CVE-2020-1440
CVE-2020-1218
CVE-2020-1335
CVE-2020-1332
CVE-2020-1460
CVE-2020-1523

Impacts
?
ACE 
[?]

OSI 
[?]

PE 
[?]

SUI 
[?]
Related products
Microsoft Office
Microsoft Excel
Microsoft Word
Microsoft Windows
CVE-IDS
?
CVE-2020-14527.5Critical
CVE-2020-13454.3Warning
CVE-2020-12244.3Warning
CVE-2020-12273.5Warning
CVE-2020-12007.5Critical
CVE-2020-15956.5High
CVE-2020-12054.9Warning
CVE-2020-14537.5Critical
CVE-2020-15753.5Warning
CVE-2020-15766.5High
CVE-2020-168513.6Warning
CVE-2020-11936.8High
CVE-2020-168523.6Warning
CVE-2020-15143.5Warning
CVE-2020-15946.8High
CVE-2020-168554.3Warning
CVE-2020-11984.3Warning
CVE-2020-14824.3Warning
CVE-2020-168533.6Warning
CVE-2020-12106.5High
CVE-2020-13386.8High
CVE-2020-14404.0Warning
CVE-2020-12186.8High
CVE-2020-13356.8High
CVE-2020-13326.8High
CVE-2020-14606.5High
CVE-2020-15234.0Warning
KB list

4484533
4484503
4486660
4486667
4484515
4484530
4484512
4484506
4484469
4486665
4484504
4486661
4484522
4484526
4484510
4484518
4484528
4484480
3101523
4484513
4484517
4486664
4484525
4484514
4484505
4484516
4484507
4484488
4484466
4484532

Microsoft official advisories
Microsoft Security Update Guide
Find out the statistics of the vulnerabilities spreading in your region