Kaspersky Threats

Detect date

?

04/13/2021

Severity

?

High

Description

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, cause denial of service.

Below is a complete list of vulnerabilities:

A remote code execution vulnerability in Microsoft Excel can be exploited remotely to execute arbitrary code.
A remote code execution vulnerability in Microsoft Office can be exploited remotely to execute arbitrary code.
An information disclosure vulnerability in Microsoft Excel can be exploited remotely to obtain sensitive information.
A remote code execution vulnerability in Microsoft Word can be exploited remotely to execute arbitrary code.
A denial of service vulnerability in Microsoft SharePoint can be exploited remotely to cause denial of service.
A memory corruption vulnerability in Microsoft Outlook can be exploited remotely to execute arbitrary code.

Affected products

Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft Word 2016 (32-bit edition)
Microsoft Word 2013 RT Service Pack 1
Microsoft Office 2016 (32-bit edition)
Microsoft Word 2013 Service Pack 1 (64-bit editions)
Microsoft Office Online Server
Microsoft Excel 2013 Service Pack 1 (64-bit editions)
Microsoft Outlook 2016 (64-bit edition)
Microsoft Outlook 2013 RT Service Pack 1
Microsoft Outlook 2013 Service Pack 1 (32-bit editions)
Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft Excel 2016 (64-bit edition)
Microsoft SharePoint Server 2010 Service Pack 2
Microsoft SharePoint Enterprise Server 2016
Microsoft Outlook 2010 Service Pack 2 (64-bit editions)
Microsoft SharePoint Server 2019
Microsoft SharePoint Foundation 2010 Service Pack 2
Microsoft Office 2010 Service Pack 2 (32-bit editions)
Microsoft Office 2016 (64-bit edition)
Microsoft Word 2010 Service Pack 2 (64-bit editions)
Microsoft Office 2010 Service Pack 2 (64-bit editions)
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft Office 2013 RT Service Pack 1
Microsoft Word 2016 (64-bit edition)
Microsoft Outlook 2010 Service Pack 2 (32-bit editions)
Microsoft Office Web Apps 2010 Service Pack 2
Microsoft Office Web Apps Server 2013 Service Pack 1
Microsoft Outlook 2013 Service Pack 1 (64-bit editions)
Microsoft Excel 2016 (32-bit edition)
Microsoft Office 2019 for Mac
Microsoft Excel 2013 RT Service Pack 1
Microsoft Excel 2010 Service Pack 2 (64-bit editions)
Microsoft Office 2019 for 64-bit editions
Microsoft Outlook 2016 (32-bit edition)
Microsoft Word 2013 Service Pack 1 (32-bit editions)
Microsoft Word 2010 Service Pack 2 (32-bit editions)
Microsoft Excel 2010 Service Pack 2 (32-bit editions)
Microsoft Office 2019 for 32-bit editions
Microsoft Office 2013 Service Pack 1 (64-bit editions)

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories

CVE-2021-28454
CVE-2021-28449
CVE-2021-28456
CVE-2021-28451
CVE-2021-28453
CVE-2021-28450
CVE-2021-28452

Impacts

?

ACE

[?]

OSI

[?]

DoS

[?]

Detect date ?	04/13/2021
Severity ?	High
Description	Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, cause denial of service. Below is a complete list of vulnerabilities: A remote code execution vulnerability in Microsoft Excel can be exploited remotely to execute arbitrary code. A remote code execution vulnerability in Microsoft Office can be exploited remotely to execute arbitrary code. An information disclosure vulnerability in Microsoft Excel can be exploited remotely to obtain sensitive information. A remote code execution vulnerability in Microsoft Word can be exploited remotely to execute arbitrary code. A denial of service vulnerability in Microsoft SharePoint can be exploited remotely to cause denial of service. A memory corruption vulnerability in Microsoft Outlook can be exploited remotely to execute arbitrary code.
Affected products	Microsoft Excel 2013 Service Pack 1 (32-bit editions) Microsoft Office 2013 Service Pack 1 (32-bit editions) Microsoft 365 Apps for Enterprise for 32-bit Systems Microsoft Word 2016 (32-bit edition) Microsoft Word 2013 RT Service Pack 1 Microsoft Office 2016 (32-bit edition) Microsoft Word 2013 Service Pack 1 (64-bit editions) Microsoft Office Online Server Microsoft Excel 2013 Service Pack 1 (64-bit editions) Microsoft Outlook 2016 (64-bit edition) Microsoft Outlook 2013 RT Service Pack 1 Microsoft Outlook 2013 Service Pack 1 (32-bit editions) Microsoft SharePoint Enterprise Server 2013 Service Pack 1 Microsoft Excel 2016 (64-bit edition) Microsoft SharePoint Server 2010 Service Pack 2 Microsoft SharePoint Enterprise Server 2016 Microsoft Outlook 2010 Service Pack 2 (64-bit editions) Microsoft SharePoint Server 2019 Microsoft SharePoint Foundation 2010 Service Pack 2 Microsoft Office 2010 Service Pack 2 (32-bit editions) Microsoft Office 2016 (64-bit edition) Microsoft Word 2010 Service Pack 2 (64-bit editions) Microsoft Office 2010 Service Pack 2 (64-bit editions) Microsoft 365 Apps for Enterprise for 64-bit Systems Microsoft Office 2013 RT Service Pack 1 Microsoft Word 2016 (64-bit edition) Microsoft Outlook 2010 Service Pack 2 (32-bit editions) Microsoft Office Web Apps 2010 Service Pack 2 Microsoft Office Web Apps Server 2013 Service Pack 1 Microsoft Outlook 2013 Service Pack 1 (64-bit editions) Microsoft Excel 2016 (32-bit edition) Microsoft Office 2019 for Mac Microsoft Excel 2013 RT Service Pack 1 Microsoft Excel 2010 Service Pack 2 (64-bit editions) Microsoft Office 2019 for 64-bit editions Microsoft Outlook 2016 (32-bit edition) Microsoft Word 2013 Service Pack 1 (32-bit editions) Microsoft Word 2010 Service Pack 2 (32-bit editions) Microsoft Excel 2010 Service Pack 2 (32-bit editions) Microsoft Office 2019 for 32-bit editions Microsoft Office 2013 Service Pack 1 (64-bit editions)
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories	CVE-2021-28454 CVE-2021-28449 CVE-2021-28456 CVE-2021-28451 CVE-2021-28453 CVE-2021-28450 CVE-2021-28452
Impacts ?	ACE [?] OSI [?] DoS [?]
Related products	Microsoft Office Microsoft Outlook Microsoft Excel Microsoft Word
CVE-IDS ?	CVE-2021-284546.8High CVE-2021-284496.8High CVE-2021-284564.3Warning CVE-2021-284516.8High CVE-2021-284536.8High CVE-2021-284504.0Warning CVE-2021-284526.8High
KB list	4504719 4493215 4504729 4504733 3178643 3178639 4504735 4493198 4493201 4504722 4504709 4493218 4504727 4493208 4504716 4504701 4504714 4504739 4504738 4504712 4504724 3017810 2589361 4493185 4504723 4504726 2553491 4504705 4504715 4504721 4493170
	Find out the statistics of the vulnerabilities spreading in your region

KLA12138Multiple vulnerabilities in Microsoft Office

KLA12138
Multiple vulnerabilities in Microsoft Office