KLA10995
Multiple arbitrary code execution vulnerabilities in Microsoft office

Multiple serious vulnerabilities have been found in Microsoft products. Malicious users can exploit these vulnerabilities to execute arbitrary code.

Below is a complete list of vulnerabilities:

1. An improper validation of input before loading DLL files can be exploited remotely via a specially designed office document to execute arbitrary code;
2. An incorrect parsing of files can be exploited locally via a specially designed file or remotely via email containg specially designed office document to execute arbitrary code.

Technical details

Vulnerability (1) exists in Microsoft OneNote products from the list; vulnerability (2) exists in the rest of the affected products list.

Windows Vista Service Pack 2
Windows 7 Service Pack 1
Windows Server 2008 Service Pack 2
Windows Server 2008 R2 Service Pack 1
Windows Server 2012
Microsoft Office 2007 Service Pack 3
Microsoft Office 2010 Service Pack 2
Microsoft Office 2013 Service Pack 1
Microsoft Office 2016
Microsoft OneNote 2007 Service Pack 3
Microsoft OneNote 2010 Service Pack 2

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)