PT-2016-7279 · Microsoft · Office+1

Published 2016-12-13 · Updated 2018-10-12 · CVE-2016-7267

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016

Description A security feature bypass issue exists in Microsoft Office software due to improper handling of file formats. This issue does not directly allow arbitrary code execution but can be exploited in conjunction with another vulnerability, such as a remote code execution vulnerability, to run arbitrary code. An attacker would need to convince a user to open a specially crafted file with an affected version of Microsoft Office software to exploit this issue.

Recommendations For Microsoft Excel 2010 SP2, update to a version that properly handles file formats to prevent exploitation. For Microsoft Excel 2013 SP1 and 2013 RT SP1, update to a version that properly handles file formats to prevent exploitation. For Microsoft Excel 2016, update to a version that properly handles file formats to prevent exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-7267

Affected Products

Office Excel

Office

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7267 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7267 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7267 · Vendor Advisory
• http://securitytracker.com/id/1037441 · Note
• http://securityfocus.com/bid/94664 · Note
• http://technet.microsoft.com/library/security/MS16-148 · Note