KLA11386 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in Microsoft Excel can be exploited remotely via specially crafted file to execute arbitrary code.
2. An elevation of privilege vulnerability in Microsoft SharePoint Server can be exploited remotely via specially crafted authentication to gain privileges.
3. An information disclosure vulnerability in Microsoft Excel can be exploited remotely to obtain sensitive information.
4. An information disclosure vulnerability in Microsoft SharePoint can be exploited remotely to obtain sensitive information.
5. A remote code execution vulnerability in Microsoft Outlook can be exploited remotely via specially crafted file to execute arbitrary code.
6. A remote code execution vulnerability in Microsoft PowerPoint can be exploited remotely via specially crafted file to execute arbitrary code.
7. A cross-site-scripting (XSS) vulnerability Microsoft Office SharePoint can be exploited remotely via specially crafted web-page to spoof user interface.
8. An information disclosure vulnerability in Microsoft Excel can be exploited remotely via specially crafted file to obtain sensitive information.

Original advisories

CVE-2018-8597

CVE-2018-8635

CVE-2018-8598

CVE-2018-8636

CVE-2018-8580

CVE-2018-8587

CVE-2018-8628

CVE-2018-8650

CVE-2018-8627

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Office

Microsoft-Outlook

Microsoft-Excel

CVE list

CVE-2018-8597 critical

CVE-2018-8635 high

CVE-2018-8598 warning

CVE-2018-8636 critical

CVE-2018-8580 warning

CVE-2018-8587 critical

CVE-2018-8628 critical

CVE-2018-8650 warning

CVE-2018-8627 warning

KB list

4011680

4461577

4461542

4461559

4461570

4461565

4461558

4461541

4461465

4461549

4461580

4461556

4461544

4461576

4461521

4011027

4461481

4461548

2597975

4461532

4011207

2965312

4092472

4461551

4461569

4461566

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft Excel 2016 (32-bit edition)Microsoft Excel 2016 (64-bit edition)Office 365 ProPlus for 32-bit SystemsMicrosoft Office 2010 Service Pack 2 (64-bit editions)Microsoft Office Compatibility Pack Service Pack 3Microsoft Office 2019 for 64-bit editionsMicrosoft Excel 2013 Service Pack 1 (64-bit editions)Microsoft Office 2010 Service Pack 2 (32-bit editions)Microsoft Excel 2013 Service Pack 1 (32-bit editions)Microsoft Office 2019 for MacMicrosoft Excel 2010 Service Pack 2 (64-bit editions)Microsoft Excel 2010 Service Pack 2 (32-bit editions)Microsoft Office 2016 for MacMicrosoft Office 2019 for 32-bit editionsOffice 365 ProPlus for 64-bit SystemsMicrosoft Excel 2013 RT Service Pack 1Microsoft SharePoint Enterprise Server 2013 Service Pack 1Microsoft SharePoint Enterprise Server 2016Microsoft SharePoint Server 2010 Service Pack 2Microsoft SharePoint Foundation 2010 Service Pack 2Microsoft Outlook 2010 Service Pack 2 (64-bit editions)Microsoft Outlook 2016 (64-bit edition)Microsoft Outlook 2013 Service Pack 1 (64-bit editions)Microsoft Outlook 2010 Service Pack 2 (32-bit editions)Microsoft Outlook 2016 (32-bit edition)Microsoft Outlook 2013 RT Service Pack 1Microsoft Outlook 2013 Service Pack 1 (32-bit editions)Microsoft PowerPoint 2013 Service Pack 1 (32-bit editions)Microsoft PowerPoint 2016 (32-bit edition)Microsoft Office Web Apps 2013 Service Pack 1Office Online ServerMicrosoft PowerPoint ViewerMicrosoft Office Web Apps 2010 Service Pack 2Microsoft SharePoint Server 2013 Service Pack 1Microsoft PowerPoint 2016 (64-bit edition)Microsoft PowerPoint 2010 Service Pack 2 (32-bit editions)Microsoft SharePoint Server 2019Microsoft PowerPoint 2013 Service Pack 1 (64-bit editions)Microsoft PowerPoint 2013 RT Service Pack 1Microsoft PowerPoint 2010 Service Pack 2 (64-bit editions)Excel ServicesMicrosoft Excel Viewer 2007 Service Pack 3