KLA12042 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, gain privileges.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in Microsoft Word can be exploited remotely to execute arbitrary code.
2. A remote code execution vulnerability in Microsoft SharePoint Server can be exploited remotely to execute arbitrary code.
3. A tampering vulnerability in Microsoft SharePoint Server can be exploited remotely to spoof user interface.
4. A remote code execution vulnerability in Microsoft Excel can be exploited remotely to execute arbitrary code.
5. A spoofing vulnerability in Microsoft SharePoint can be exploited remotely to spoof user interface.
6. A remote code execution vulnerability in Microsoft Office can be exploited remotely to execute arbitrary code.
7. An elevation of privilege vulnerability in Microsoft SharePoint can be exploited remotely to gain privileges.

Original advisories

CVE-2021-1716

CVE-2021-1715

CVE-2021-1707

CVE-2021-1718

CVE-2021-1714

CVE-2021-1641

CVE-2021-1711

CVE-2021-1717

CVE-2021-1712

CVE-2021-1713

CVE-2021-1719

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Office

Microsoft-Excel

Microsoft-Word

CVE list

CVE-2021-1716 critical

CVE-2021-1715 critical

CVE-2021-1707 critical

CVE-2021-1718 critical

CVE-2021-1714 critical

CVE-2021-1641 warning

CVE-2021-1711 critical

CVE-2021-1717 warning

CVE-2021-1712 critical

CVE-2021-1713 critical

CVE-2021-1719 critical

KB list

4493175

4493186

4486762

4493178

4486683

4493145

4486755

4486736

4493160

4493165

4493142

4493176

4486759

4493171

4493143

4493156

4493163

4493167

4486764

4493187

4493183

4493162

4493168

4493181

4486724

4493161

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft Excel 2010 Service Pack 2 (64-bit editions)Microsoft Excel 2013 Service Pack 1 (64-bit editions)Microsoft Word 2016 (64-bit edition)Microsoft Word 2013 RT Service Pack 1Microsoft Word 2013 Service Pack 1 (64-bit editions)Microsoft Office 2010 Service Pack 2 (32-bit editions)Microsoft SharePoint Server 2019Microsoft Excel 2013 RT Service Pack 1Microsoft SharePoint Foundation 2013 Service Pack 1Microsoft Excel 2016 (32-bit edition)Microsoft 365 Apps for Enterprise for 32-bit SystemsMicrosoft Office 2016 (64-bit edition)Microsoft SharePoint Foundation 2010 Service Pack 2Microsoft Office 2019 for 64-bit editionsMicrosoft Word 2010 Service Pack 2 (64-bit editions)Microsoft Office 2016 (32-bit edition)Microsoft SharePoint Server 2010 Service Pack 2Microsoft Office Online ServerMicrosoft Word 2010 Service Pack 2 (32-bit editions)Microsoft Office 2013 Service Pack 1 (64-bit editions)Microsoft Excel 2016 (64-bit edition)Microsoft Word 2016 (32-bit edition)Microsoft Office Web Apps Server 2013 Service Pack 1Microsoft Office 2019 for 32-bit editionsMicrosoft Excel 2013 Service Pack 1 (32-bit editions)Microsoft Office 2013 RT Service Pack 1Microsoft Office 2013 Service Pack 1 (32-bit editions)Microsoft Office 2010 Service Pack 2 (64-bit editions)Microsoft SharePoint Enterprise Server 2016Microsoft Excel 2010 Service Pack 2 (32-bit editions)Microsoft Office Web Apps 2010 Service Pack 2Microsoft SharePoint Enterprise Server 2013 Service Pack 1Excel ServicesMicrosoft 365 Apps for Enterprise for 64-bit SystemsMicrosoft Word 2013 Service Pack 1 (32-bit editions)Microsoft Office 2019 for Mac