Lucene search

[email protected]CVE-2017-11825

HistoryOct 13, 2017 - 1:29 p.m.

CVE-2017-11825

2017-10-1313:29:02

CWE-119

[email protected]

web.nvd.nist.gov

microsoft office

2016

vulnerability

remote code execution

cve-2017-11825

nvd

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.184 Low

EPSS

Percentile

96.2%

JSON

Microsoft Office 2016 Click-to-Run (C2R) and Microsoft Office 2016 for Mac allow an attacker to use a specially crafted file to perform actions in the security context of the current user, due to how Microsoft Office handles files in memory, aka “Microsoft Office Remote Code Execution Vulnerability”.

Affected configurations

Vulners

NVD

Node

microsoft_corporationmicrosoft_office_2016\,_microsoft_office_2016_for_mac

CPENameOperatorVersion
microsoft:officemicrosoft officeeq2016
microsoft:office_for_macmicrosoft office for maceq2016

CPE	Name	Operator	Version
microsoft:office	microsoft office	eq	2016
microsoft:office_for_mac	microsoft office for mac	eq	2016

CNA Affected

[
  {
    "product": "Microsoft Office 2016, Microsoft Office 2016 for Mac",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Microsoft Office 2016 Click-to-Run (C2R) and Microsoft Office 2016 for Mac"
      }
    ]
  }
]