Lucene search

[email protected]CVE-2017-0105

HistoryMar 17, 2017 - 12:59 a.m.

CVE-2017-0105

2017-03-1700:59:02

CWE-200

[email protected]

web.nvd.nist.gov

microsoft

office

information disclosure

vulnerability

cve-2017-0105

nvd

memory disclosure

remote attack

sharepoint

word

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

5.5 Medium

AI Score

Confidence

High

0.938 High

EPSS

Percentile

99.2%

JSON

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from out-of-bound memory via a crafted Office document, aka “Microsoft Office Information Disclosure Vulnerability.”

Affected configurations

Vulners

NVD

Node

microsoft_corporationoffice

CPENameOperatorVersion
microsoft:officemicrosoft officeeq2010
microsoft:office_compatibility_packmicrosoft office compatibility packeq-
microsoft:office_web_appsmicrosoft office web appseq2010
microsoft:sharepoint_servermicrosoft sharepoint servereq2010
microsoft:wordmicrosoft wordeq2007
microsoft:word_automation_servicesmicrosoft word automation serviceseq-
microsoft:word_for_macmicrosoft word for maceq2011

CPE	Name	Operator	Version
microsoft:office	microsoft office	eq	2010
microsoft:office_compatibility_pack	microsoft office compatibility pack	eq	-
microsoft:office_web_apps	microsoft office web apps	eq	2010
microsoft:sharepoint_server	microsoft sharepoint server	eq	2010
microsoft:word	microsoft word	eq	2007
microsoft:word_automation_services	microsoft word automation services	eq	-
microsoft:word_for_mac	microsoft word for mac	eq	2011

CNA Affected

[
  {
    "product": "Office",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2"
      }
    ]
  }
]