PT-2016-7286 · Microsoft · Office

Published 2016-12-13 · Updated 2018-10-30 · CVE-2016-7275

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office versions 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016

Description The issue allows local users to gain privileges via a crafted application. A remote code execution vulnerability exists when Microsoft Office improperly validates input before loading libraries. An attacker who successfully exploited the issue could take control of an affected system, then install programs, view, change, or delete data, or create new accounts with full user rights. Users with fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Recommendations For Microsoft Office 2010 SP2, update to a version that properly validates input before loading libraries. For Microsoft Office 2013 SP1, update to a version that properly validates input before loading libraries. For Microsoft Office 2013 RT SP1, update to a version that properly validates input before loading libraries. For Microsoft Office 2016, update to a version that properly validates input before loading libraries. As a temporary workaround, consider restricting library loading to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-19

CWE-264

Related Identifiers

CVE-2016-7275

Affected Products

Office

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7275 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7275 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7275 · Security Note
• http://securitytracker.com/id/1037441 · Note
• http://securityfocus.com/bid/94665 · Note
• http://technet.microsoft.com/library/security/MS16-148 · Note