PT-2014-7186 · Microsoft · Office Compatibility Pack+1

Published 2014-12-09 · Updated 2018-10-12 · CVE-2014-6360

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2007 SP3 through 2010 SP2 Office Compatibility Pack (affected versions not specified)

Description A remote code execution issue exists due to improper handling of objects in memory while parsing specially crafted Office files, potentially corrupting system memory and allowing an attacker to execute arbitrary code. This could enable an attacker to run arbitrary code in the context of the current user, potentially taking complete control of the affected system if the user has administrative rights.

Recommendations For Microsoft Excel 2007 SP3, update to a version that is not affected by this issue. For Microsoft Excel 2010 SP2, update to a version that is not affected by this issue. For Office Compatibility Pack, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2014-6360

Affected Products

Office Excel

Office Compatibility Pack

References · 5

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-6360 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6360 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6360 · Note
• http://technet.microsoft.com/security/bulletin/ms14-083 · Note