PT-2018-18548 · Microsoft · Office Word+2

Jonathan Birch · Publicado 2018-07-10 · Atualizado 2020-08-24 · CVE-2018-8310

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Outlook (affected versions not specified) Microsoft Word (affected versions not specified) Microsoft Office (affected versions not specified)

Description A tampering issue exists due to improper handling of specific attachment types when rendering HTML emails. An attacker could exploit this by sending a specially crafted email and attachment to a victim, or by hosting a malicious .eml file on a web server. Successful exploitation could allow embedding untrusted TrueType fonts in an email, potentially leading to further system compromise when combined with other exploits.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2018-8310

Produtos afetados

Office

Outlook

Office Word

Referências · 6

• https://osv.dev/vulnerability/CVE-2018-8310 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8310 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8310 · Aviso do Fabricante
• http://securityfocus.com/bid/104615 · Nota
• http://securitytracker.com/id/1041274 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-8310 · Nota de Segurança