PT-2016-7292 · Microsoft · Office+5

Publicado 2016-12-20 · Atualizado 2018-10-12 · CVE-2016-7291

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Word versions 2007 SP3 Office versions 2010 SP2 Word versions 2010 SP2 Office Compatibility Pack versions SP3 Word for Mac versions 2011 Word Automation Services on SharePoint Server versions 2010 SP2 Office Web Apps versions 2010 SP2

Description The issue allows remote attackers to obtain sensitive information from process memory or cause a denial of service via a crafted document. This is due to an out-of-bounds read.

Recommendations For Microsoft Word 2007 SP3, update to a newer version to mitigate the risk. For Office 2010 SP2, update to a newer version to mitigate the risk. For Word 2010 SP2, update to a newer version to mitigate the risk. For Office Compatibility Pack SP3, update to a newer version to mitigate the risk. For Word for Mac 2011, update to a newer version to mitigate the risk. For Word Automation Services on SharePoint Server 2010 SP2, update to a newer version to mitigate the risk. For Office Web Apps 2010 SP2, update to a newer version to mitigate the risk.

Correção

DoS

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

CVE-2016-7291

Produtos afetados

Office Word

Office

Office Compatibility Pack

Office Web Apps

Sharepoint Server

Word For Mac

Referências · 5

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148 · Aviso do Fabricante
• http://securitytracker.com/id/1037441 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7291 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-7291 · Aviso do Fabricante
• http://securityfocus.com/bid/94671 · Nota