Security Advisory - Remote Code Execution Vulnerability in Microsoft Office

2017-12-2000:00:00

Huawei Technologies

www.huawei.com

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.955 High

EPSS

Percentile

99.4%

JSON

Microsoft released a security advisory to disclose a remote code execution vulnerability in Microsoft Office. Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office. The attacker could exploit the vulnerability to run arbitrary code in the context of the current user. (Vulnerability ID: HWPSIRT-2017-10074)

This vulnerability has been assigned a Common Vulnerabilities and Exposures (CVE) ID: CVE-2017-11826.

Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171220-01-office-en