KLA11512 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information, spoof user interface.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in Microsoft Excel can be exploited remotely via specially designed document to execute arbitrary code.
2. An information disclosure vulnerability in Microsoft Exchange can be exploited remotely to obtain sensitive information.
3. A spoofing vulnerability in Microsoft Office can be exploited remotely to spoof user interface.
4. An information disclosure vulnerability in Microsoft Excel can be exploited remotely to obtain sensitive information.
5. A cross-site-scripting (XSS) vulnerability Microsoft Office SharePoint can be exploited remotely via specially crafted web request to spoof user interface

Original advisories

CVE-2019-1110

CVE-2019-1084

CVE-2019-1111

CVE-2019-1109

CVE-2019-1112

CVE-2019-1134

CVE-2019-1006

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Lync

Microsoft-Office

Microsoft-Outlook

Microsoft-Excel

CVE list

CVE-2019-1006 warning

CVE-2019-1084 warning

CVE-2019-1110 critical

CVE-2019-1111 critical

CVE-2019-1109 high

CVE-2019-1112 warning

CVE-2019-1134 warning

KB list

4464592

4464558

4475517

4475509

4475514

4475545

4475519

4475513

4464572

4464565

4464543

4461539

4462224

4464534

4018375

4475529

4475520

4475522

4475527

4475510

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft Office 2016 for MacMicrosoft Excel 2010 Service Pack 2 (64-bit editions)Microsoft Office 2019 for MacMicrosoft Excel 2016 (32-bit edition)Office 365 ProPlus for 64-bit SystemsOffice 365 ProPlus for 32-bit SystemsMicrosoft Excel 2013 Service Pack 1 (32-bit editions)Microsoft Excel 2010 Service Pack 2 (32-bit editions)Microsoft Office 2019 for 64-bit editionsMicrosoft Excel 2016 (64-bit edition)Microsoft Excel 2013 RT Service Pack 1Microsoft Excel 2013 Service Pack 1 (64-bit editions)Microsoft Office 2019 for 32-bit editionsMicrosoft Outlook 2016 (32-bit edition)Microsoft Office 2016 (64-bit edition)Skype for Business 2016 (32-bit)Microsoft Office 2016 (32-bit edition)Skype for Business 2016 Basic (64-bit)Microsoft Exchange Server 2019 Cumulative Update 2Microsoft Lync 2013 Service Pack 1 (32-bit)Mail and CalendarSkype for Business 2016 Basic (32-bit)Microsoft Office 2013 Service Pack 1 (32-bit editions)Outlook for iOSMicrosoft Exchange Server 2013 Cumulative Update 23Skype for Business 2016 (64-bit)Microsoft Outlook 2013 Service Pack 1 (32-bit editions)Microsoft Exchange Server 2016 Cumulative Update 12Microsoft Outlook for AndroidMicrosoft Office 2013 Service Pack 1 (64-bit editions)Microsoft Lync Basic 2013 Service Pack 1 (32-bit)Microsoft Lync Basic 2013 Service Pack 1 (64-bit)Microsoft Lync 2013 Service Pack 1 (64-bit)Microsoft Outlook 2013 Service Pack 1 (64-bit editions)Microsoft Office 2013 RT Service Pack 1Microsoft Outlook 2010 Service Pack 2 (64-bit editions)Microsoft Outlook 2016 (64-bit edition)Microsoft Exchange Server 2019 Cumulative Update 1Microsoft Exchange Server 2010 Service Pack 3Microsoft Exchange Server 2016 Cumulative Update 13Microsoft Outlook 2010 Service Pack 2 (32-bit editions)Microsoft Office 2010 Service Pack 2 (64-bit editions)Microsoft Office 2010 Service Pack 2 (32-bit editions)Microsoft SharePoint Enterprise Server 2013 Service Pack 1Microsoft SharePoint Enterprise Server 2016Microsoft SharePoint Server 2019