PT-2019-1164 · Microsoft · Office Online Server+6

Publicado 2019-01-08 · Atualizado 2020-08-24 · CVE-2019-0585

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Word (affected versions not specified) Microsoft Office (affected versions not specified) Microsoft Office Word Viewer (affected versions not specified) Office 365 ProPlus (affected versions not specified) Microsoft SharePoint (affected versions not specified) Microsoft Office Online Server (affected versions not specified) Microsoft SharePoint Server (affected versions not specified) Office Web Apps Server (affected versions not specified) SharePoint Enterprise Server (affected versions not specified)

Description: A remote code execution issue exists due to improper handling of objects in memory. This could allow a remote attacker to execute arbitrary code using a specially crafted file, performing actions in the security context of the current user.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2019-00208

CVE-2019-0585

ZDI-19-054

Produtos afetados

Office

Office Online Server

Office Word Viewer

Sharepoint Server

Office Word

Office 365 Proplus

Office Web Apps Server

Referências · 7

• https://bdu.fstec.ru/vul/2019-00208 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-19-054 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-0585 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-0585 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0585 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0585 · Aviso do Fabricante
• http://securityfocus.com/bid/106392 · Nota