KLA11577 Multiple vulnerability in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to spoof user interface, gain privileges, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. A cross-site-scripting (XSS) vulnerability Microsoft Office SharePoint can be exploited remotely via specially crafted web to spoof user interface.
2. An elevation of privilege vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted web to gain privileges.
3. A spoofing vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted web to spoof user interface.
4. A remote code execution vulnerability in Microsoft Excel can be exploited remotely via specially crafted file to execute arbitrary code.
5. An elevation of privilege vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted request to gain privileges.

Original advisories

CVE-2019-1070

CVE-2019-1329

CVE-2019-1328

CVE-2019-1331

CVE-2019-1327

CVE-2019-1330

Related products

Microsoft-Office

Microsoft-Excel

CVE list

CVE-2019-1070 warning

CVE-2019-1329 warning

CVE-2019-1328 warning

CVE-2019-1331 critical

CVE-2019-1327 critical

CVE-2019-1330 warning

KB list

4484122

4484111

4475554

4484110

4475569

4484131

4475558

4484130

4462176

4484112

4484123

4462215

4475595

4475608

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Excel ServicesMicrosoft Excel 2016 (32-bit edition)Office Online ServerMicrosoft Office 2016 (32-bit edition)Microsoft Office 2019 for MacMicrosoft SharePoint Enterprise Server 2013 Service Pack 1Microsoft Office 2013 Service Pack 1 (32-bit editions)Microsoft Excel 2010 Service Pack 2 (64-bit editions)Microsoft Office 2016 for MacMicrosoft Office 2016 (64-bit edition)Microsoft Office 2013 Service Pack 1 (64-bit editions)Microsoft Office 2013 RT Service Pack 1Microsoft Excel 2013 RT Service Pack 1Office 365 ProPlus for 32-bit SystemsMicrosoft Office 2019 for 32-bit editionsMicrosoft SharePoint Foundation 2010 Service Pack 2Microsoft SharePoint Foundation 2013 Service Pack 1Office 365 ProPlus for 64-bit SystemsMicrosoft Excel 2013 Service Pack 1 (64-bit editions)Microsoft Excel 2010 Service Pack 2 (32-bit editions)Microsoft Office 2010 Service Pack 2 (64-bit editions)Microsoft Office 2010 Service Pack 2 (32-bit editions)Microsoft SharePoint Server 2019Microsoft Excel 2013 Service Pack 1 (32-bit editions)Microsoft Office 2019 for 64-bit editionsMicrosoft Excel 2016 (64-bit edition)Microsoft SharePoint Enterprise Server 2016