PT-2016-7279 · Microsoft · Office+1

Publicado 2016-12-13 · Atualizado 2018-10-12 · CVE-2016-7267

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016

Description A security feature bypass issue exists in Microsoft Office software due to improper handling of file formats. This issue does not directly allow arbitrary code execution but can be exploited in conjunction with another vulnerability, such as a remote code execution vulnerability, to run arbitrary code. An attacker would need to convince a user to open a specially crafted file with an affected version of Microsoft Office software to exploit this issue.

Recommendations For Microsoft Excel 2010 SP2, update to a version that properly handles file formats to prevent exploitation. For Microsoft Excel 2013 SP1 and 2013 RT SP1, update to a version that properly handles file formats to prevent exploitation. For Microsoft Excel 2016, update to a version that properly handles file formats to prevent exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-7267

Produtos afetados

Office Excel

Office

Referências · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148 · Aviso do Fabricante
• http://securitytracker.com/id/1037441 · Nota
• http://securityfocus.com/bid/94664 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7267 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7267 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-7267 · Aviso do Fabricante
• http://technet.microsoft.com/library/security/MS16-148 · Nota