PT-2015-3020 · Microsoft · Office Compatibility Pack+3

Published 2015-12-08 · Updated 2026-05-14 · CVE-2015-6172

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Word versions 2007 SP3 through 2016 Office versions 2010 SP2 Word 2010 version SP2 Word 2013 versions SP1 through RT SP1 Office Compatibility Pack version SP3

Description The issue allows remote attackers to execute arbitrary code via a crafted email message processed by Outlook. This is due to insufficient input validation in Microsoft Office, specifically in the way Outlook parses specially crafted email messages. An attacker who successfully exploits this could run arbitrary code as the logged-on user and take complete control of the affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability can be exploited when a user opens or previews a specially crafted email message with an affected version of Microsoft Outlook.

Recommendations For Microsoft Word 2007 SP3, update to a version that includes the fix for this issue. For Office 2010 SP2, apply the recommended configuration changes to mitigate the risk. For Word 2010 SP2, consider disabling the processing of specially crafted email messages until a patch is available. For Word 2013 SP1 and RT SP1, restrict access to the vulnerable component in Outlook to minimize the risk of exploitation. For Office Compatibility Pack SP3, avoid using the affected version of Outlook to process email messages until the issue is resolved. For all affected versions, as a temporary workaround, consider implementing additional security measures such as restricting user rights and closely monitoring system activity for signs of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-00224

CVE-2015-6172

Affected Products

Office Word

Office

Office Compatibility Pack

Outlook

References · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-131 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-00224 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6172 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6172 · Security Note
• http://securitytracker.com/id/1034325 · Note
• http://technet.microsoft.com/security/bulletin/ms15-131 · Note
• https://twitter.com/ElusivePrivacy/status/2055016698009288776 · Twitter Post
• http://technet.microsoft.com/security/bulletin/MS15-131 · Note