PT-2014-7187 · Microsoft · Office Compatibility Pack+1

Publicado 2014-12-09 · Atualizado 2018-10-12 · CVE-2014-6361

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2007 SP3 through 2013 SP1 Office Compatibility Pack (affected versions not specified)

Description A remote code execution issue exists due to improper handling of objects in memory while parsing specially crafted Office files, potentially corrupting system memory and allowing an attacker to execute arbitrary code. If successfully exploited, an attacker could run arbitrary code in the context of the current user, potentially taking complete control of the affected system if the user has administrative rights.

Recommendations For Microsoft Excel versions 2007 SP3 through 2013 SP1, update to a version that properly handles objects in memory to prevent arbitrary code execution. For Office Compatibility Pack, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2014-6361

Produtos afetados

Office Excel

Office Compatibility Pack

Referências · 5

• http://technet.microsoft.com/security/bulletin/ms14-083 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6361 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-083 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6361 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-6361 · Nota de Segurança