KLA11808 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to spoof user interface, gain privileges, execute arbitrary code, bypass security restrictions, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. A cross-site-scripting (XSS) vulnerability Microsoft Office SharePoint can be exploited remotely via specially crafted web to spoof user interface.
2. A spoofing vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted web to spoof user interface.
3. An elevation of privilege vulnerability in Microsoft SharePoint can be exploited remotely via specially crafted request to gain privileges.
4. Unspecified Microsoft can be exploited remotely via specially crafted to spoof user interface.
5. A remote code execution vulnerability in Microsoft SharePoint Server can be exploited remotely via specially crafted page to execute arbitrary code.
6. A security feature bypass vulnerability in Microsoft Outlook can be exploited remotely via specially crafted image to bypass security restrictions.
7. A remote code execution vulnerability in Microsoft Office can be exploited remotely via specially crafted file to execute arbitrary code.
8. An elevation of privilege vulnerability in Microsoft SharePoint Server can be exploited remotely via specially crafted authentication to gain privileges.
9. An information disclosure vulnerability in Microsoft Project can be exploited remotely via specially crafted file to obtain sensitive information.
10. A remote code execution vulnerability in Microsoft Excel can be exploited remotely via specially crafted file to execute arbitrary code.

Original advisories

CVE-2020-1298

CVE-2020-1289

CVE-2020-1177

CVE-2020-1318

CVE-2020-1295

CVE-2020-1320

CVE-2020-1323

CVE-2020-1148

CVE-2020-1181

CVE-2020-1229

CVE-2020-1183

CVE-2020-1321

CVE-2020-1178

CVE-2020-1297

CVE-2020-1322

CVE-2020-1225

CVE-2020-1226

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Office

Microsoft-Excel

Microsoft-Word

CVE list

CVE-2020-1298 warning

CVE-2020-1289 warning

CVE-2020-1177 warning

CVE-2020-1318 warning

CVE-2020-1295 high

CVE-2020-1320 warning

CVE-2020-1323 high

CVE-2020-1148 warning

CVE-2020-1181 high

CVE-2020-1229 warning

CVE-2020-1183 warning

CVE-2020-1321 high

CVE-2020-1178 high

CVE-2020-1297 warning

CVE-2020-1322 warning

CVE-2020-1225 critical

CVE-2020-1226 critical

KB list

4484414

4484399

4484402

4484409

4484361

4484380

4484415

4484405

4484410

4484396

4484369

4484378

4484351

4484403

4484373

4484387

4484391

4484342

4484400

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft Office 2019 for 32-bit editionsMicrosoft Office 2010 Service Pack 2 (32-bit editions)Microsoft Project 2013 Service Pack 1 (64-bit editions)Microsoft Office 2013 RT Service Pack 1Microsoft 365 Apps for Enterprise for 64-bit SystemsMicrosoft SharePoint Enterprise Server 2016Microsoft Word 2013 RT Service Pack 1Microsoft Word 2010 Service Pack 2 (32-bit editions)Microsoft Office 2010 Service Pack 2 (64-bit editions)Microsoft Project 2016 (32-bit edition)Microsoft Word 2010 Service Pack 2 (64-bit editions)Microsoft Project 2010 Service Pack 2 (64-bit editions)Microsoft Office 2016 (32-bit edition)Microsoft Office 2013 Service Pack 1 (64-bit editions)Microsoft Excel 2010 Service Pack 2 (32-bit editions)Microsoft Office 2016 for MacMicrosoft Excel 2013 Service Pack 1 (64-bit editions)Microsoft SharePoint Foundation 2010 Service Pack 2Microsoft Project 2013 Service Pack 1 (32-bit editions)Microsoft Word 2013 Service Pack 1 (32-bit editions)Microsoft Excel 2013 Service Pack 1 (32-bit editions)Microsoft Office 2019 for MacMicrosoft Project 2010 Service Pack 2 (32-bit editions)Microsoft Excel 2013 RT Service Pack 1Microsoft Word 2016 (32-bit edition)Microsoft SharePoint Foundation 2013 Service Pack 1Microsoft SharePoint Server 2019Microsoft Project 2016 (64-bit edition)Microsoft SharePoint Enterprise Server 2013 Service Pack 1Microsoft Word 2016 (64-bit edition)Microsoft Office 2013 Service Pack 1 (32-bit editions)Microsoft 365 Apps for Enterprise for 32-bit SystemsMicrosoft Excel 2010 Service Pack 2 (64-bit editions)Microsoft Excel 2016 (64-bit edition)Microsoft Office 2019 for 64-bit editionsMicrosoft Office 2016 (64-bit edition)Microsoft Excel 2016 (32-bit edition)Microsoft Word 2013 Service Pack 1 (64-bit editions)Microsoft SharePoint Server 2010 Service Pack 2