PT-2017-10455 · Microsoft · Office Compatibility Pack+2

Publicado 2017-04-11 · Atualizado 2017-07-11 · CVE-2017-0194

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2007 SP3 through 2010 SP2 Office Compatibility Pack version SP2

Description The issue allows remote attackers to obtain sensitive information from process memory via a crafted Office document. This is related to improper disclosure of the contents of Microsoft Office memory, which could be used to compromise the user's computer or data.

Recommendations For Microsoft Excel 2007 SP3, update to a version that fixes the information disclosure issue. For Microsoft Excel 2010 SP2, update to a version that fixes the information disclosure issue. For Office Compatibility Pack SP2, update to a version that fixes the information disclosure issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-0194

Produtos afetados

Office Excel

Office

Office Compatibility Pack

Referências · 5

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0194 · Aviso do Fabricante
• http://securityfocus.com/bid/97436 · Nota
• https://osv.dev/vulnerability/CVE-2017-0194 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-0194 · Nota de Segurança
• http://securitytracker.com/id/1038244 · Nota