Lucene search

[email protected]CVE-2018-0812

HistoryJan 10, 2018 - 1:29 a.m.

CVE-2018-0812

2018-01-1001:29:01

CWE-787

[email protected]

web.nvd.nist.gov

In Wild

microsoft

office

equation editor

remote code execution

vulnerability

memory corruption

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.2 High

AI Score

Confidence

High

0.108 Low

EPSS

Percentile

95.1%

JSON

Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka “Microsoft Word Memory Corruption Vulnerability”.

Affected configurations

Vulners

NVD

Node

microsoft_corporationequation_editor

CPENameOperatorVersion
microsoft:officemicrosoft officeeq2007
microsoft:officemicrosoft officeeq2010
microsoft:officemicrosoft officeeq2013
microsoft:officemicrosoft officeeq2016
microsoft:office_compatibility_packmicrosoft office compatibility packeq-
microsoft:wordmicrosoft wordeq2007
microsoft:wordmicrosoft wordeq2010
microsoft:wordmicrosoft wordeq2013
microsoft:wordmicrosoft wordeq2016

CPE	Name	Operator	Version
microsoft:office	microsoft office	eq	2007
microsoft:office	microsoft office	eq	2010
microsoft:office	microsoft office	eq	2013
microsoft:office	microsoft office	eq	2016
microsoft:office_compatibility_pack	microsoft office compatibility pack	eq	-
microsoft:word	microsoft word	eq	2007
microsoft:word	microsoft word	eq	2010
microsoft:word	microsoft word	eq	2013
microsoft:word	microsoft word	eq	2016

CNA Affected

[
  {
    "product": "Equation Editor",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016"
      }
    ]
  }
]