KLA10616
Multiple vulnerabilities in Microsoft Office

Multiple serious vulnerabilities have been found in Microsoft Office products. Malicious users can exploit these vulnerabilities to run arbitrary code, cause denial of service, loss of integrity, security bypass, privilege escalation and obtain sensitive information.

Below is a complete list of vulnerabilities

1. Microsoft Office improperly handles objects in memory while parsing crafted Office files which can lead to execution of arbitrary code in the context of the current user. If the current user have administrative user rights, malicious users could take complete control of the system. Users who have fewer user rights could be less impacted.
2. Vulnerability in Microsoft IME (Japanese) component can lead to gain access to the affected system with logged-in user rights. If the current user have administrative user rights, malicious users could take complete control of the system. Users who have fewer user rights could be less impacted.
3. MSCOMCTL common controls library does not properly implement ASLR which can lead to bypass the ASLR security feature via crafted web site. This vulnerability also known as «MSCOMCTL ASLR Vulnerability».
4. Microsoft Office does not properly handle a crafted response while opening an Office document via web site which can lead to obtain sensitive token information. This information can be used to authenticate the current user on a targeted Microsoft online service. This vulnerability also known as «Token Reuse Vulnerability».
5. Vulnerability in Microsoft Publisher library pubconv.dll can lead to execution arbitrary code as the current user via crafted files with ‘.pub’ extension. This vulnerability also known as «Arbitrary Pointer Dereference Vulnerability».
6. Microsoft Office incorrect allocated memory while converting specially crafted files to a newer format which can lead to executing arbitrary code. If the current user have administrative user rights, malicious users could take complete control of the system. Users who have fewer user rights could be less impacted.
7. Microsoft Word has stack-buffer overflow vulnerability while opening specially crafted documents. This vulnerability can lead to executing arbitrary code as the current user. If the current user have administrative user rights, malicious users could take complete control of the system. Users who have fewer user rights could be less impacted. This vulnerability also known as «Microsoft Word Stack Overflow Vulnerability».
8. Microsoft Word has remote code execution vulnerability while parses specially crafted RTF data. This vulnerability can lead to executing arbitrary code as the current user. If the current user have administrative user rights, malicious users could take complete control of the system.
9. Microsoft Office has remote code execution vulnerability while opening crafted Office document. This vulnerability can lead to executing arbitrary code and cause denial of service. Also malicious users can gain access to the affected system with logged-in user rights. If the current user have administrative user rights, malicious users could take complete control of the system. Users who have fewer user rights could be less impacted. This vulnerability also known as «Word Memory Corruption Vulnerability».
10. Microsoft OneNote has remote code execution vulnerability while opening crafted OneNote file. This vulnerability can lead to executing arbitrary code as the current user. If the current user have administrative user rights, malicious users could take complete control of the system. Users who have fewer user rights could be less impacted. This vulnerability also known as «OneNote Remote Code Execution Vulnerability».
11. Vulnerability in usp.dll library in the Unicode Script Processor can lead to executing arbitrary code or cause denial of service. Also malicious users can take complete control of the system. This vulnerability also known as «Unicode Scripts Processor Vulnerability».
12. Vulnerability in GDI+ which can lead to executing arbitrary code via crafted image file. Also malicious users can take complete control of the system. This vulnerability also known as «GDI+ Image Parsing Vulnerability».

Microsoft Office 2003,
Microsoft Office 2007,
Microsoft Office 2010,
Microsoft Office 2013,
Microsoft Office 2013 RT,
Microsoft Office for Mac,
Microsoft Word Viewer,
Microsoft Office Web Apps,
Microsoft SharePoint Server,
Microsoft Office Compatibility Pack,
Microsoft OneNote.

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)