KLA11349 Multiple vulnerabilities in Microsoft Office

Multiple serious vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, gain privileges, cause denial of service.

Below is a complete list of vulnerabilities:

1. A vulnerability in Microsoft Outlook can be exploited remotely via specially crafted email to execute arbitrary code.
2. A vulnerability in Microsoft Outlook can be exploited remotely via specially designed e-mail to obtain sensitive information.
3. A vulnerability in Microsoft Outlook can be exploited remotely via specially crafted file to execute arbitrary code.
4. A vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted web request to gain privileges.
5. A vulnerability in Microsoft SharePoint can be exploited remotely via specially designed request to gain privileges.
6. A vulnerability in Microsoft Outlook can be exploited remotely via specially crafted file to execute arbitrary code.
7. A vulnerability in Microsoft Word can be exploited remotely via specially crafted file to execute arbitrary code.
8. A vulnerability in Microsoft Skype for Business can be exploited remotely via specially designed e-mail to cause denial of service.
9. A vulnerability in Microsoft Outlook can be exploited remotely via specially designed e-mail to obtain sensitive information.
10. A vulnerability in Microsoft Word can be exploited remotely via specially crafted file to execute arbitrary code.
11. A vulnerability in Microsoft Project can be exploited remotely via specially crafted file to execute arbitrary code.
12. A vulnerability in Microsoft Excel can be exploited remotely via specially crafted file to execute arbitrary code.
13. A vulnerability in Microsoft Outlook can be exploited remotely via specially crafted file to execute arbitrary code.
14. A vulnerability in Microsoft SharePoint can be exploited remotely via specially designed request to obtain sensitive information.
15. A vulnerability in Microsoft Excel can be exploited remotely via specially crafted file to execute arbitrary code.

Original advisories

CVE-2018-8582

CVE-2018-8558

CVE-2018-8576

CVE-2018-8568

CVE-2018-8572

CVE-2018-8522

CVE-2018-8539

CVE-2018-8546

CVE-2018-8579

CVE-2018-8573

CVE-2018-8575

CVE-2018-8574

CVE-2018-8524

CVE-2018-8578

CVE-2018-8577

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Lync

Microsoft-Office-Access

Microsoft-Office-PowerPoint

Microsoft-Office-Visio-2007

Microsoft-Office-Visio

Microsoft-Office-Professional-Plus-2010

Microsoft-Office

Microsoft-Outlook

Microsoft-Excel

CVE list

CVE-2018-8582 critical

CVE-2018-8558 warning

CVE-2018-8576 critical

CVE-2018-8568 warning

CVE-2018-8572 warning

CVE-2018-8522 critical

CVE-2018-8539 critical

CVE-2018-8546 warning

CVE-2018-8579 warning

CVE-2018-8573 critical

CVE-2018-8575 critical

CVE-2018-8574 critical

CVE-2018-8524 critical

CVE-2018-8578 warning

CVE-2018-8577 critical

KB list

4461486

4461506

4461529

4461501

4461483

4461513

4461511

4461520

3114565

4461527

4461473

4461487

4461504

4461485

4461524

4461526

4461489

4461478

4022147

4461503

4011190

4032218

4461519

4092473

4022232

4461530

4461488

4461518

4022237

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Microsoft Outlook 2016 (64-bit edition)Microsoft Outlook 2010 Service Pack 2 (32-bit editions)Office 365 ProPlus for 64-bit SystemsMicrosoft Office 2019 for 64-bit editionsMicrosoft Outlook 2016 (32-bit edition)Microsoft Office 2019 for 32-bit editionsMicrosoft Outlook 2013 Service Pack 1 (32-bit editions)Office 365 ProPlus for 32-bit SystemsMicrosoft Outlook 2013 Service Pack 1 (64-bit editions)Microsoft Outlook 2013 RT Service Pack 1Microsoft Outlook 2010 Service Pack 2 (64-bit editions)Microsoft SharePoint Server 2019Microsoft SharePoint Enterprise Server 2013 Service Pack 1Microsoft SharePoint Enterprise Server 2016Microsoft SharePoint Foundation 2013 Service Pack 1Microsoft Office 2010 Service Pack 2 (64-bit editions)Microsoft SharePoint Server 2010 Service Pack 2Microsoft Office Web Apps 2010 Service Pack 2Microsoft Office 2010 Service Pack 2 (32-bit editions)Microsoft Lync 2013 Service Pack 1 (64-bit)Skype for Business 2016 (32-bit)Skype for Business 2016 (64-bit)Microsoft Lync Basic 2013 Service Pack 1 (64-bit)Microsoft Lync Basic 2013 Service Pack 1 (32-bit)Microsoft Lync 2013 Service Pack 1 (32-bit)Skype for Business 2016 Basic (32-bit)Skype for Business 2016 Basic (64-bit)Microsoft Word 2013 RT Service Pack 1Microsoft Word 2016 (32-bit edition)Microsoft Word 2010 Service Pack 2 (32-bit editions)Microsoft Word 2013 Service Pack 1 (64-bit editions)Microsoft Word 2013 Service Pack 1 (32-bit editions)Microsoft Word 2010 Service Pack 2 (64-bit editions)Microsoft Word 2016 (64-bit edition)Microsoft Project 2010 Service Pack 2 (64-bit editions)Microsoft Project Server 2013 Service Pack 1 (32-bit edition)Microsoft Project 2010 Service Pack 2 (32-bit editions)Microsoft Project Server 2013 Service Pack 1 (64-bit edition)Microsoft Project 2016 (32-bit edition)Microsoft Project 2016 (64-bit edition)Microsoft Excel 2016 (64-bit edition)Microsoft Excel 2016 (32-bit edition)Microsoft Office 2016 for MacMicrosoft Office 2019 for MacMicrosoft Office 2016 (64-bit edition)Microsoft Office 2013 RT Service Pack 1Microsoft Excel Viewer 2007 Service Pack 3Microsoft Office 2013 Service Pack 1 (32-bit editions)Microsoft Office 2013 Service Pack 1 (64-bit editions)Excel ServicesMicrosoft Office 2016 (32-bit edition)Microsoft Excel 2010 Service Pack 2 (64-bit editions)Microsoft Office Compatibility Pack Service Pack 3Microsoft Office Web Apps Server 2013 Service Pack 1Microsoft Excel 2013 Service Pack 1 (64-bit editions)Microsoft Excel 2010 Service Pack 2 (32-bit editions)Microsoft Excel 2013 Service Pack 1 (32-bit editions)Microsoft Excel 2013 RT Service Pack 1