PT-2015-5772 · Microsoft · Office For Mac+2

Publicado 2015-08-11 · Atualizado 2018-10-12 · CVE-2015-2477

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2007 SP3 Office for Mac versions 2011 Office for Mac versions 2016 Word Viewer (affected versions not specified)

Description A remote code execution issue exists in Microsoft Office software due to its failure to properly handle objects in memory. An attacker could exploit this by using a specially crafted file, allowing them to perform actions in the security context of the current user. This requires a user to open the specially crafted file with an affected version of Microsoft Office software.

Recommendations For Microsoft Office 2007 SP3, update to a version that properly handles objects in memory to prevent exploitation. For Office for Mac 2011, consider disabling the opening of specially crafted files until a patch is available. For Office for Mac 2016, restrict access to files from untrusted sources to minimize the risk of exploitation. For Word Viewer, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2015-2477

Produtos afetados

Office

Office For Mac

Word Viewer

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-2477 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2477 · Nota de Segurança
• http://securitytracker.com/id/1033239 · Nota
• http://technet.microsoft.com/security/bulletin/ms15-081 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-081 · Aviso do Fabricante