KLA12023 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, obtain sensitive information, bypass security restrictions, gain privileges.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in Microsoft Excel can be exploited remotely to execute arbitrary code.
2. A spoofing vulnerability in Microsoft SharePoint can be exploited remotely to spoof user interface.
3. A remote code execution vulnerability in Microsoft SharePoint can be exploited remotely to execute arbitrary code.
4. An information disclosure vulnerability in Microsoft SharePoint can be exploited remotely to obtain sensitive information.
5. A security feature bypass vulnerability in Microsoft Excel can be exploited remotely to bypass security restrictions.
6. An information disclosure vulnerability in Microsoft Excel can be exploited remotely to obtain sensitive information.
7. A remote code execution vulnerability in Microsoft PowerPoint can be exploited remotely to execute arbitrary code.
8. An elevation of privilege vulnerability in Microsoft SharePoint can be exploited remotely to gain privileges.
9. An information disclosure vulnerability in Microsoft Outlook can be exploited remotely to obtain sensitive information.

Original advisories

CVE-2020-17129

CVE-2020-17128

CVE-2020-17115

CVE-2020-17123

CVE-2020-17122

CVE-2020-17121

CVE-2020-17120

CVE-2020-17130

CVE-2020-17126

CVE-2020-17125

CVE-2020-17124

CVE-2020-17127

CVE-2020-17089

CVE-2020-17118

CVE-2020-17119

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Office

Microsoft-Outlook

Microsoft-Excel

CVE list

CVE-2020-17129 critical

CVE-2020-17128 critical

CVE-2020-17115 critical

CVE-2020-17123 critical

CVE-2020-17122 critical

CVE-2020-17121 critical

CVE-2020-17120 high

CVE-2020-17130 high

CVE-2020-17126 high

CVE-2020-17125 critical

CVE-2020-17124 critical

CVE-2020-17127 critical

CVE-2020-17089 high

CVE-2020-17118 critical

CVE-2020-17119 high

KB list

4493139

4493138

4486732

4484468

4484372

4484393

4486750

4486753

4486752

4486754

4486757

4486698

4493140

4486748

4493148

4493149

4486696

4486697

4486721

4486742

4486704

4486760

4486751

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft SharePoint Server 2019Microsoft PowerPoint 2016 (32-bit edition)Microsoft Excel 2010 Service Pack 2 (32-bit editions)Microsoft PowerPoint 2013 Service Pack 1 (32-bit editions)Microsoft Excel 2016 (64-bit edition)Office Online ServerMicrosoft Office 2019 for MacMicrosoft Excel 2013 Service Pack 1 (64-bit editions)Microsoft Office 2016 (32-bit edition)Microsoft Office 2019 for 64-bit editionsMicrosoft Excel 2013 RT Service Pack 1Microsoft SharePoint Enterprise Server 2016Microsoft Outlook 2013 Service Pack 1 (32-bit editions)Microsoft Office 2010 Service Pack 2 (64-bit editions)Microsoft PowerPoint 2016 (64-bit edition)Microsoft Excel 2010 Service Pack 2 (64-bit editions)Microsoft Outlook 2010 Service Pack 2 (32-bit editions)Microsoft Office 2019 for 32-bit editionsMicrosoft Office 2016 (64-bit edition)Microsoft Outlook 2010 Service Pack 2 (64-bit editions)Microsoft PowerPoint 2010 Service Pack 2 (64-bit editions)Microsoft SharePoint Foundation 2010 Service Pack 2Microsoft Office 2010 Service Pack 2 (32-bit editions)Microsoft SharePoint Server 2010 Service Pack 2Microsoft Outlook 2013 Service Pack 1 (64-bit editions)Microsoft PowerPoint 2013 RT Service Pack 1Microsoft Office Web Apps 2010 Service Pack 2Microsoft Office Web Apps 2013 Service Pack 1Microsoft Excel 2013 Service Pack 1 (32-bit editions)Microsoft SharePoint Foundation 2013 Service Pack 1Microsoft 365 Apps for Enterprise for 64-bit SystemsMicrosoft Excel 2016 (32-bit edition)Microsoft 365 Apps for Enterprise for 32-bit SystemsMicrosoft PowerPoint 2013 Service Pack 1 (64-bit editions)Microsoft PowerPoint 2010 Service Pack 2 (32-bit editions)Microsoft Office Online ServerMicrosoft Outlook 2016 (64-bit edition)Microsoft Outlook 2013 RT Service Pack 1Microsoft Outlook 2016 (32-bit edition)