Kaspersky Threats

Detect date

?

03/14/2023

Severity

?

Critical

Description

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to spoof user interface, obtain sensitive information, gain privileges, execute arbitrary code, cause denial of service.

Below is a complete list of vulnerabilities:

A spoofing vulnerability in Microsoft Excel can be exploited remotely to spoof user interface.
A spoofing vulnerability in Office for Android can be exploited remotely to spoof user interface.
An information disclosure vulnerability in Microsoft OneDrive for Android can be exploited remotely to obtain sensitive information.
An elevation of privilege vulnerability in Microsoft Outlook can be exploited remotely to gain privileges.
An elevation of privilege vulnerability in Microsoft OneDrive for MacOS can be exploited remotely to gain privileges.
An elevation of privilege vulnerability in Windows Graphics Component can be exploited remotely to gain privileges.
A spoofing vulnerability in Microsoft SharePoint Server can be exploited remotely to spoof user interface.
A remote code execution vulnerability in Microsoft Excel can be exploited remotely to execute arbitrary code.
A denial of service vulnerability in Microsoft Excel can be exploited remotely to cause denial of service.

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Affected products

Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft Excel 2016 (64-bit edition)
Microsoft SharePoint Server 2019
Microsoft Office 2019 for 32-bit editions
Microsoft Outlook 2013 Service Pack 1 (32-bit editions)
Microsoft Outlook 2013 RT Service Pack 1
Microsoft Outlook 2016 (32-bit edition)
Microsoft Office Online Server
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft Office 2016 (64-bit edition)
Microsoft Office for Universal
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft Outlook 2013 Service Pack 1 (64-bit editions)
Microsoft SharePoint Server Subscription Edition
Microsoft Office Web Apps Server 2013 Service Pack 1
Microsoft Outlook 2016 (64-bit edition)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft Office LTSC for Mac 2021
Microsoft SharePoint Enterprise Server 2016
Microsoft Excel 2013 RT Service Pack 1
OneDrive for MacOS Installer
Microsoft Office LTSC 2021 for 32-bit editions
Microsoft Office 2019 for 64-bit editions
Microsoft Excel 2016 (32-bit edition)
Microsoft Office for Android
OneDrive for Android
Microsoft Office 2013 RT Service Pack 1
Microsoft Office LTSC 2021 for 64-bit editions
Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft Office 2019 for Mac
Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft Excel 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2016 (32-bit edition)

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update component usually can be accessed from the Control Panel) and updates from the Update Options section, that are listed in your Office Account (Office Account tab usually can be accessed from the File menu)
Install Office updates

Original advisories

CVE-2023-23398
CVE-2023-23391
CVE-2023-24923
CVE-2023-24882
CVE-2023-23397
CVE-2023-24930
CVE-2023-24910
CVE-2023-23395
CVE-2023-23399
CVE-2023-23396

Impacts

?

ACE

[?]

OSI

[?]

DoS

[?]

PE

[?]

SUI

[?]

Detect date ?	03/14/2023
Severity ?	Critical
Description	Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to spoof user interface, obtain sensitive information, gain privileges, execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: A spoofing vulnerability in Microsoft Excel can be exploited remotely to spoof user interface. A spoofing vulnerability in Office for Android can be exploited remotely to spoof user interface. An information disclosure vulnerability in Microsoft OneDrive for Android can be exploited remotely to obtain sensitive information. An elevation of privilege vulnerability in Microsoft Outlook can be exploited remotely to gain privileges. An elevation of privilege vulnerability in Microsoft OneDrive for MacOS can be exploited remotely to gain privileges. An elevation of privilege vulnerability in Windows Graphics Component can be exploited remotely to gain privileges. A spoofing vulnerability in Microsoft SharePoint Server can be exploited remotely to spoof user interface. A remote code execution vulnerability in Microsoft Excel can be exploited remotely to execute arbitrary code. A denial of service vulnerability in Microsoft Excel can be exploited remotely to cause denial of service.
Exploitation	Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.
Affected products	Microsoft Excel 2013 Service Pack 1 (32-bit editions) Microsoft 365 Apps for Enterprise for 64-bit Systems Microsoft Excel 2016 (64-bit edition) Microsoft SharePoint Server 2019 Microsoft Office 2019 for 32-bit editions Microsoft Outlook 2013 Service Pack 1 (32-bit editions) Microsoft Outlook 2013 RT Service Pack 1 Microsoft Outlook 2016 (32-bit edition) Microsoft Office Online Server Microsoft Office 2013 Service Pack 1 (32-bit editions) Microsoft Office 2016 (64-bit edition) Microsoft Office for Universal Microsoft SharePoint Foundation 2013 Service Pack 1 Microsoft Outlook 2013 Service Pack 1 (64-bit editions) Microsoft SharePoint Server Subscription Edition Microsoft Office Web Apps Server 2013 Service Pack 1 Microsoft Outlook 2016 (64-bit edition) Microsoft Office 2013 Service Pack 1 (64-bit editions) Microsoft Office LTSC for Mac 2021 Microsoft SharePoint Enterprise Server 2016 Microsoft Excel 2013 RT Service Pack 1 OneDrive for MacOS Installer Microsoft Office LTSC 2021 for 32-bit editions Microsoft Office 2019 for 64-bit editions Microsoft Excel 2016 (32-bit edition) Microsoft Office for Android OneDrive for Android Microsoft Office 2013 RT Service Pack 1 Microsoft Office LTSC 2021 for 64-bit editions Microsoft SharePoint Enterprise Server 2013 Service Pack 1 Microsoft Office 2019 for Mac Microsoft 365 Apps for Enterprise for 32-bit Systems Microsoft Excel 2013 Service Pack 1 (64-bit editions) Microsoft Office 2016 (32-bit edition)
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update component usually can be accessed from the Control Panel) and updates from the Update Options section, that are listed in your Office Account (Office Account tab usually can be accessed from the File menu) Install Office updates
Original advisories	CVE-2023-23398 CVE-2023-23391 CVE-2023-24923 CVE-2023-24882 CVE-2023-23397 CVE-2023-24930 CVE-2023-24910 CVE-2023-23395 CVE-2023-23399 CVE-2023-23396
Impacts ?	ACE [?] OSI [?] DoS [?] PE [?] SUI [?]
Related products	Microsoft Office Microsoft Outlook Microsoft Excel Microsoft SharePoint OneDrive
KB list	5002254 5002356 5002197 5002358 5002351 5002265 5002367 5002368 5002198 5002355 5002362 5002366 5002168 5002348
Microsoft official advisories	Microsoft Security Update Guide
	Find out the statistics of the vulnerabilities spreading in your region

KLA48560Multiple vulnerabilities in Microsoft Office

KLA48560
Multiple vulnerabilities in Microsoft Office