KLA11536 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to spoof user interface, execute arbitrary code, gain privileges, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. A cross-site-scripting (XSS) vulnerability Microsoft Office SharePoint can be exploited remotely via specially crafted web to spoof user interface.
2. A spoofing vulnerability in Outlook iOS can be exploited remotely via specially crafted email to spoof user interface.
3. A remote code execution vulnerability in Microsoft Word can be exploited remotely via specially crafted file to execute arbitrary code.
4. An elevation of privilege vulnerability in Microsoft Outlook can be exploited remotely via specially crafted email to gain privileges.
5. A memory corruption vulnerability in Microsoft Outlook can be exploited remotely via specially crafted file to execute arbitrary code.
6. A remote code execution vulnerability in Microsoft Outlook can be exploited remotely via specially crafted file to execute arbitrary code.
7. An information disclosure vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted application to obtain sensitive information.
8. An information disclosure vulnerability in Microsoft Graphics Component can be exploited remotely via specially crafted application to obtain sensitive information.
9. A remote code execution vulnerability in Jet Database Engine can be exploited remotely via specially crafted file to execute arbitrary code.
10. A remote code execution vulnerability in Microsoft Graphics can be exploited remotely via specially crafted embedded to execute arbitrary code.

Original advisories

CVE-2019-1203

CVE-2019-1218

CVE-2019-1205

CVE-2019-1204

CVE-2019-1199

CVE-2019-1200

CVE-2019-1202

CVE-2019-1153

CVE-2019-1155

CVE-2019-1201

CVE-2019-1149

CVE-2019-1148

CVE-2019-1151

ADV190014

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Office

Microsoft-Outlook

CVE list

CVE-2019-1153 warning

CVE-2019-1151 critical

CVE-2019-1148 warning

CVE-2019-1155 critical

CVE-2019-1149 critical

CVE-2019-1203 warning

CVE-2019-1218 warning

CVE-2019-1205 critical

CVE-2019-1204 warning

CVE-2019-1199 critical

CVE-2019-1200 critical

CVE-2019-1202 warning

CVE-2019-1201 critical

KB list

4475506

4475538

4464599

4475555

4475549

4475557

4475528

4475563

4475573

4475553

4475565

4475575

4475530

4475540

4475547

4462137

4475531

4462216

4475534

4475533

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft SharePoint Enterprise Server 2016Microsoft SharePoint Enterprise Server 2013 Service Pack 1Microsoft SharePoint Server 2019Outlook for iOSMicrosoft Office 2019 for 64-bit editionsMicrosoft Office 2019 for MacMicrosoft Office Online ServerOffice 365 ProPlus for 32-bit SystemsMicrosoft Office 2019 for 32-bit editionsMicrosoft Office 2016 for MacOffice 365 ProPlus for 64-bit SystemsMicrosoft Outlook 2016 (64-bit edition)Microsoft Outlook 2013 Service Pack 1 (32-bit editions)Microsoft Outlook 2016 (32-bit edition)Microsoft Outlook 2010 Service Pack 2 (64-bit editions)Microsoft Outlook 2013 RT Service Pack 1Microsoft Outlook 2013 Service Pack 1 (64-bit editions)Microsoft Outlook 2010 Service Pack 2 (32-bit editions)Microsoft SharePoint Foundation 2010 Service Pack 2Microsoft SharePoint Foundation 2013 Service Pack 1Windows Server 2012Windows 10 Version 1809 for ARM64-based SystemsWindows Server 2019 (Server Core installation)Windows Server 2016 (Server Core installation)Windows 10 Version 1803 for x64-based SystemsWindows Server 2008 for x64-based Systems Service Pack 2Windows Server 2008 for 32-bit Systems Service Pack 2Windows 10 Version 1607 for 32-bit SystemsWindows 10 Version 1703 for x64-based SystemsWindows 10 Version 1607 for x64-based SystemsWindows Server, version 1903 (Server Core installation)Windows 10 Version 1903 for 32-bit SystemsWindows 10 Version 1709 for 32-bit SystemsWindows 7 for x64-based Systems Service Pack 1Windows 8.1 for 32-bit systemsWindows 10 Version 1903 for ARM64-based SystemsWindows Server 2012 R2Windows Server 2012 R2 (Server Core installation)Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1Windows 10 Version 1903 for x64-based SystemsWindows 10 Version 1803 for ARM64-based SystemsWindows RT 8.1Windows 10 Version 1809 for 32-bit SystemsWindows Server, version 1803 (Server Core Installation)Windows 10 Version 1809 for x64-based SystemsWindows Server 2016Windows 8.1 for x64-based systemsWindows 10 Version 1709 for 64-based SystemsWindows Server 2008 for Itanium-Based Systems Service Pack 2Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)Windows 10 Version 1709 for ARM64-based SystemsWindows 10 Version 1803 for 32-bit SystemsWindows 10 for x64-based SystemsWindows 10 Version 1703 for 32-bit SystemsWindows 10 for 32-bit SystemsWindows Server 2008 R2 for x64-based Systems Service Pack 1Windows Server 2012 (Server Core installation)Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)Windows 7 for 32-bit Systems Service Pack 1Windows Server 2019Microsoft Office 2013 Service Pack 1 (32-bit editions)Microsoft Office 2016 (64-bit edition)Microsoft Office 2013 RT Service Pack 1Microsoft Office 2010 Service Pack 2 (32-bit editions)Microsoft Office 2013 Service Pack 1 (64-bit editions)Microsoft Office 2010 Service Pack 2 (64-bit editions)Microsoft Office 2016 (32-bit edition)Microsoft Office Web Apps 2010 Service Pack 2Microsoft Office Web Apps Server 2013 Service Pack 1Microsoft Word 2010 Service Pack 2 (32-bit editions)Microsoft Word 2013 Service Pack 1 (32-bit editions)Microsoft Word 2013 Service Pack 1 (64-bit editions)Microsoft Word 2016 (32-bit edition)Microsoft Word 2016 (64-bit edition)Microsoft SharePoint Server 2010 Service Pack 2Microsoft Word 2013 RT Service Pack 1Microsoft Word 2010 Service Pack 2 (64-bit editions)