KLA11604 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, spoof user interface, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. An information disclosure vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted file to obtain sensitive information.
2. A security feature bypass vulnerability in Microsoft Office ClickToRun can be exploited remotely via specially crafted file to bypass security restrictions.
3. A spoofing vulnerability in Microsoft Office Online can be exploited remotely via specially crafted request to spoof user interface.
4. An information disclosure vulnerability in Microsoft Excel can be exploited remotely to obtain sensitive information.
5. A remote code execution vulnerability in Microsoft Excel can be exploited remotely via specially crafted file to execute arbitrary code.
6. Unspecified Microsoft Office can be exploited remotely via specially crafted file to bypass security restrictions.
7. An information disclosure vulnerability in Microsoft Office can be exploited remotely via specially crafted application to obtain sensitive information.
8. A security feature bypass vulnerability in Microsoft Office can be exploited remotely via specially crafted file to bypass security restrictions.

Original advisories

CVE-2019-1443

CVE-2019-1449

CVE-2019-1447

CVE-2019-1446

CVE-2019-1445

CVE-2019-1448

CVE-2019-1457

CVE-2019-1402

CVE-2019-1442

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Office

Microsoft-Excel

CVE list

CVE-2019-1443 warning

CVE-2019-1449 critical

CVE-2019-1447 high

CVE-2019-1446 warning

CVE-2019-1445 high

CVE-2019-1448 critical

CVE-2019-1457 high

CVE-2019-1402 warning

CVE-2019-1442 warning

KB list

4484142

4484148

4484159

4484119

4484143

4484164

4484160

4484113

4484149

4484151

4484144

4484127

4484141

4484158

4484157

4484165

4484152

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft Office 2019 for MacMicrosoft Office 2010 Service Pack 2 (64-bit editions)Microsoft SharePoint Enterprise Server 2016Office 365 ProPlus for 32-bit SystemsMicrosoft Office Online ServerMicrosoft Office 2016 (64-bit edition)Microsoft Excel 2013 Service Pack 1 (64-bit editions)Microsoft SharePoint Enterprise Server 2013 Service Pack 1Microsoft Office 2013 RT Service Pack 1Microsoft SharePoint Foundation 2010 Service Pack 2Microsoft SharePoint Foundation 2013 Service Pack 1Microsoft Excel 2016 for MacMicrosoft Office 2010 Service Pack 2 (32-bit editions)Microsoft Excel 2013 Service Pack 1 (32-bit editions)Microsoft Office 2016 for MacMicrosoft Excel 2010 Service Pack 2 (64-bit editions)Microsoft Excel 2013 RT Service Pack 1Microsoft Office 2013 Service Pack 1 (64-bit editions)Microsoft Excel 2010 Service Pack 2 (32-bit editions)Microsoft Office 2019 for 64-bit editionsMicrosoft Office 2013 Service Pack 1 (32-bit editions)Microsoft Office 2019 for 32-bit editionsMicrosoft Office 2016 (32-bit edition)Microsoft Excel 2016 (64-bit edition)Office 365 ProPlus for 64-bit SystemsMicrosoft SharePoint Server 2019Excel ServicesOffice Online ServerMicrosoft Excel 2016 (32-bit edition)