KLA11499 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, cause denial of service.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in Microsoft Word can be exploited remotely via specially crafted file to execute arbitrary code;
2. A cross-site-scripting (XSS) vulnerability Microsoft Office SharePoint can be exploited remotely via specially crafted web to spoof user interface;
3. A denial of service vulnerability in Skype for Business and Lync Server can be exploited remotely via IMPORTANTTHING to cause denial of service;
4. A cross-site-scripting (XSS) vulnerability Microsoft Office SharePoint can be exploited remotely via specially crafted web to spoof user interface.

Original advisories

CVE-2019-1034

CVE-2019-1031

CVE-2019-1032

CVE-2019-1029

CVE-2019-1035

CVE-2019-1033

CVE-2019-1036

Related products

Microsoft-Lync

Microsoft-Word

Microsoft-Lync-Server

CVE list

CVE-2019-1034 critical

CVE-2019-1031 warning

CVE-2019-1032 warning

CVE-2019-1029 high

CVE-2019-1035 critical

CVE-2019-1033 warning

CVE-2019-1036 warning

KB list

4464596

4461619

4461621

4464594

4461611

4464590

4464602

4475511

4475512

4462178

4464597

4464571

4506009

4092442

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft SharePoint Enterprise Server 2013 Service Pack 1Microsoft Office 2019 for 32-bit editionsMicrosoft Word 2010 Service Pack 2 (64-bit editions)Microsoft Office Web Apps 2010 Service Pack 2Microsoft Word 2016 (32-bit edition)Microsoft Office 2019 for MacMicrosoft Office 2010 Service Pack 2 (64-bit editions)Microsoft Word 2010 Service Pack 2 (32-bit editions)Microsoft Office 2010 Service Pack 2 (32-bit editions)Microsoft SharePoint Enterprise Server 2016Microsoft Word 2013 RT Service Pack 1Microsoft SharePoint Server 2019Microsoft Office Online ServerOffice 365 ProPlus for 32-bit SystemsMicrosoft Word 2013 Service Pack 1 (64-bit editions)Microsoft Office 2016 for MacMicrosoft Office 2019 for 64-bit editionsOffice 365 ProPlus for 64-bit SystemsMicrosoft Word 2016 (64-bit edition)Microsoft SharePoint Server 2010 Service Pack 2Microsoft Word 2013 Service Pack 1 (32-bit editions)Microsoft SharePoint Foundation 2010 Service Pack 2Microsoft SharePoint Foundation 2013 Service Pack 1Microsoft Lync Server 2013Microsoft Lync Server 2010Microsoft Project Server 2010 Service Pack 2