KLA11080 Multiple vulnerabilities in Microsoft Office

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code and obtain sensitive information.

Below is a complete list of vulnerabilities:

1. An improper handling of input in Microsoft Office Outlook can be exploited via a specially designed document file to bypass security restrictions;
2. An incorrect disclosure the contents of memory in Microsoft Office can be exploited via a specially designed document file to obtain sensitive information;
3. An improper parsing of email messages in Microsoft Outlook can be exploited by sending a specially designed file to the user and then convincing the user to open the file to execute arbitrary code.

Original advisories

CVE-2017-8571

CVE-2017-8663

CVE-2017-8572

CVE-2017-8572

CVE-2017-8663

Related products

Microsoft-Office

Microsoft-Outlook

CVE list

CVE-2017-8571 high

CVE-2017-8572 warning

CVE-2017-8663 critical

KB list

2956078

3213643

4011052

4011078

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft Office 2010 Click-to-RunMicrosoft Office 2013 Click-to-RunMicrosoft Office 2016 Click-to-RunMicrosoft Outlook 2007 Service Pack 3Microsoft Outlook 2010 Service Pack 2Microsoft Outlook 2013 RT Service Pack 1Microsoft Outlook 2013 Service Pack 1Microsoft Outlook 2016