CVE-2015-6093

2015-11-1112:59:32

CWE-119

[email protected]

web.nvd.nist.gov

microsoft office

vulnerability

remote code execution

cve-2015-6093

nvd

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.5 High

AI Score

Confidence

Low

0.587 Medium

EPSS

Percentile

97.8%

JSON

Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Office Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka “Microsoft Office Memory Corruption Vulnerability.”

Affected configurations

NVD

Node

microsoftofficeMatch2007sp3

microsoftofficeMatch2010sp2

microsoftofficeMatch2013sp1

microsoftofficeMatch2016

microsoftoffice_web_appsMatch2010sp2

microsoftoffice_web_apps_serverMatch2013sp1

microsoftsharepoint_serverMatch2010sp2

microsoftsharepoint_serverMatch2013sp1

CPENameOperatorVersion
microsoft:officemicrosoft officeeq2007
microsoft:officemicrosoft officeeq2010
microsoft:officemicrosoft officeeq2013
microsoft:officemicrosoft officeeq2016
microsoft:office_web_appsmicrosoft office web appseq2010
microsoft:office_web_apps_servermicrosoft office web apps servereq2013
microsoft:sharepoint_servermicrosoft sharepoint servereq2010
microsoft:sharepoint_servermicrosoft sharepoint servereq2013

CPE	Name	Operator	Version
microsoft:office	microsoft office	eq	2007
microsoft:office	microsoft office	eq	2010
microsoft:office	microsoft office	eq	2013
microsoft:office	microsoft office	eq	2016
microsoft:office_web_apps	microsoft office web apps	eq	2010
microsoft:office_web_apps_server	microsoft office web apps server	eq	2013
microsoft:sharepoint_server	microsoft sharepoint server	eq	2010
microsoft:sharepoint_server	microsoft sharepoint server	eq	2013