Kaspersky Threats

Detect date

?

07/11/2023

Severity

?

Critical

Description

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, bypass security restrictions, obtain sensitive information, spoof user interface.

Below is a complete list of vulnerabilities:

A remote code execution vulnerability in Microsoft Excel can be exploited remotely to execute arbitrary code.
An elevation of privilege vulnerability in Microsoft Office can be exploited remotely to gain privileges.
A remote code execution vulnerability in Microsoft SharePoint Server can be exploited remotely to execute arbitrary code.
A remote code execution vulnerability in Microsoft Office Graphics can be exploited remotely to execute arbitrary code.
A security feature bypass vulnerability in Microsoft SharePoint Server can be exploited remotely to bypass security restrictions.
A remote code execution vulnerability in Microsoft SharePoint can be exploited remotely to execute arbitrary code.
A security feature bypass vulnerability in Microsoft Office can be exploited remotely to bypass security restrictions.
A remote code execution vulnerability in Microsoft ActiveX can be exploited remotely to execute arbitrary code.
An information disclosure vulnerability in Microsoft Excel can be exploited remotely to obtain sensitive information.
A security feature bypass vulnerability in Microsoft Outlook can be exploited remotely to bypass security restrictions.
A remote code execution vulnerability in Microsoft Outlook can be exploited remotely to execute arbitrary code.
A spoofing vulnerability in Microsoft SharePoint Server can be exploited remotely to spoof user interface.
A spoofing vulnerability in Microsoft Outlook can be exploited remotely to spoof user interface.

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Affected products

Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft Excel 2016 (64-bit edition)
Microsoft Outlook 2013 (32-bit editions)
Microsoft Word 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft Outlook 2016 (64-bit edition)
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft Excel 2013 RT Service Pack 1
Microsoft Office 2019 for 64-bit editions
Microsoft Word 2016 (64-bit edition)
Microsoft Office 2013 Click-to-Run (C2R) for 32-bit editions
Microsoft SharePoint Server 2019
Microsoft Excel 2016 (32-bit edition)
Microsoft Office 2016 (32-bit edition)
Microsoft Word 2013 Service Pack 1 (32-bit editions)
Microsoft Outlook 2013 RT Service Pack 1
Microsoft Office LTSC 2021 for 64-bit editions
Microsoft Office 2013 Click-to-Run (C2R) for 64-bit editions
Microsoft SharePoint Enterprise Server 2016
Microsoft Excel 2013 Service Pack 1 (64-bit editions)
Microsoft Office LTSC for Mac 2021
Microsoft Office Online Server
Microsoft Outlook 2016 (32-bit edition)
Microsoft Office 2019 for Mac
Microsoft Word 2013 RT Service Pack 1
Microsoft Office LTSC 2021 for 32-bit editions
Microsoft SharePoint Server Subscription Edition
Microsoft Office 2019 for 32-bit editions
Microsoft Office 2016 (64-bit edition)
Microsoft Outlook 2013 (64-bit editions)
Microsoft Office 2013 RT Service Pack 1
Microsoft Office for Universal
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft Word 2016 (32-bit edition)

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update component usually can be accessed from the Control Panel) and updates from the Update Options section, that are listed in your Office Account (Office Account tab usually can be accessed from the File menu)
Install Office updates

Original advisories

CVE-2023-33161
CVE-2023-33148
CVE-2023-33158
CVE-2023-33160
CVE-2023-33149
CVE-2023-33165
CVE-2023-33157
CVE-2023-33150
CVE-2023-33152
CVE-2023-33162
CVE-2023-33134
CVE-2023-35311
CVE-2023-33153
CVE-2023-33159
CVE-2023-33151

Impacts

?

ACE

[?]

OSI

[?]

SB

[?]

PE

[?]

SUI

[?]

Detect date ?	07/11/2023
Severity ?	Critical
Description	Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, bypass security restrictions, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: A remote code execution vulnerability in Microsoft Excel can be exploited remotely to execute arbitrary code. An elevation of privilege vulnerability in Microsoft Office can be exploited remotely to gain privileges. A remote code execution vulnerability in Microsoft SharePoint Server can be exploited remotely to execute arbitrary code. A remote code execution vulnerability in Microsoft Office Graphics can be exploited remotely to execute arbitrary code. A security feature bypass vulnerability in Microsoft SharePoint Server can be exploited remotely to bypass security restrictions. A remote code execution vulnerability in Microsoft SharePoint can be exploited remotely to execute arbitrary code. A security feature bypass vulnerability in Microsoft Office can be exploited remotely to bypass security restrictions. A remote code execution vulnerability in Microsoft ActiveX can be exploited remotely to execute arbitrary code. An information disclosure vulnerability in Microsoft Excel can be exploited remotely to obtain sensitive information. A security feature bypass vulnerability in Microsoft Outlook can be exploited remotely to bypass security restrictions. A remote code execution vulnerability in Microsoft Outlook can be exploited remotely to execute arbitrary code. A spoofing vulnerability in Microsoft SharePoint Server can be exploited remotely to spoof user interface. A spoofing vulnerability in Microsoft Outlook can be exploited remotely to spoof user interface.
Exploitation	Public exploits exist for this vulnerability. Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.
Affected products	Microsoft 365 Apps for Enterprise for 32-bit Systems Microsoft Excel 2016 (64-bit edition) Microsoft Outlook 2013 (32-bit editions) Microsoft Word 2013 Service Pack 1 (64-bit editions) Microsoft Office 2013 Service Pack 1 (32-bit editions) Microsoft Excel 2013 Service Pack 1 (32-bit editions) Microsoft Outlook 2016 (64-bit edition) Microsoft 365 Apps for Enterprise for 64-bit Systems Microsoft Excel 2013 RT Service Pack 1 Microsoft Office 2019 for 64-bit editions Microsoft Word 2016 (64-bit edition) Microsoft Office 2013 Click-to-Run (C2R) for 32-bit editions Microsoft SharePoint Server 2019 Microsoft Excel 2016 (32-bit edition) Microsoft Office 2016 (32-bit edition) Microsoft Word 2013 Service Pack 1 (32-bit editions) Microsoft Outlook 2013 RT Service Pack 1 Microsoft Office LTSC 2021 for 64-bit editions Microsoft Office 2013 Click-to-Run (C2R) for 64-bit editions Microsoft SharePoint Enterprise Server 2016 Microsoft Excel 2013 Service Pack 1 (64-bit editions) Microsoft Office LTSC for Mac 2021 Microsoft Office Online Server Microsoft Outlook 2016 (32-bit edition) Microsoft Office 2019 for Mac Microsoft Word 2013 RT Service Pack 1 Microsoft Office LTSC 2021 for 32-bit editions Microsoft SharePoint Server Subscription Edition Microsoft Office 2019 for 32-bit editions Microsoft Office 2016 (64-bit edition) Microsoft Outlook 2013 (64-bit editions) Microsoft Office 2013 RT Service Pack 1 Microsoft Office for Universal Microsoft Office 2013 Service Pack 1 (64-bit editions) Microsoft Word 2016 (32-bit edition)
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update component usually can be accessed from the Control Panel) and updates from the Update Options section, that are listed in your Office Account (Office Account tab usually can be accessed from the File menu) Install Office updates
Original advisories	CVE-2023-33161 CVE-2023-33148 CVE-2023-33158 CVE-2023-33160 CVE-2023-33149 CVE-2023-33165 CVE-2023-33157 CVE-2023-33150 CVE-2023-33152 CVE-2023-33162 CVE-2023-33134 CVE-2023-35311 CVE-2023-33153 CVE-2023-33159 CVE-2023-33151
Impacts ?	ACE [?] OSI [?] SB [?] PE [?] SUI [?]
Related products	Microsoft Office Microsoft Outlook Microsoft Excel Microsoft Word Microsoft SharePoint
CVE-IDS ?	CVE-2023-331615.0Warning CVE-2023-331485.0Warning CVE-2023-331585.0Warning CVE-2023-331605.0Warning CVE-2023-331495.0Warning CVE-2023-331655.0Warning CVE-2023-331575.0Warning CVE-2023-331505.0Warning CVE-2023-331525.0Warning CVE-2023-331625.0Warning CVE-2023-331345.0Warning CVE-2023-353115.0Warning CVE-2023-331535.0Warning CVE-2023-331595.0Warning CVE-2023-331515.0Warning
KB list	5002419 5002427 5002423 5002432 5002426 5002425 5002411 5002406 5001952 5002421 5002058 4493154 5002069 5002400 4464506 5002434 4475581 5002424
Microsoft official advisories	Microsoft Security Update Guide
	Find out the statistics of the vulnerabilities spreading in your region

KLA50773Multiple vulnerabilities in Microsoft Office

KLA50773
Multiple vulnerabilities in Microsoft Office