PT-2016-7292 · Microsoft · Office+5

Published 2016-12-20 · Updated 2018-10-12 · CVE-2016-7291

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Word versions 2007 SP3 Office versions 2010 SP2 Word versions 2010 SP2 Office Compatibility Pack versions SP3 Word for Mac versions 2011 Word Automation Services on SharePoint Server versions 2010 SP2 Office Web Apps versions 2010 SP2

Description The issue allows remote attackers to obtain sensitive information from process memory or cause a denial of service via a crafted document. This is due to an out-of-bounds read.

Recommendations For Microsoft Word 2007 SP3, update to a newer version to mitigate the risk. For Office 2010 SP2, update to a newer version to mitigate the risk. For Word 2010 SP2, update to a newer version to mitigate the risk. For Office Compatibility Pack SP3, update to a newer version to mitigate the risk. For Word for Mac 2011, update to a newer version to mitigate the risk. For Word Automation Services on SharePoint Server 2010 SP2, update to a newer version to mitigate the risk. For Office Web Apps 2010 SP2, update to a newer version to mitigate the risk.

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2016-7291

Affected Products

Office Word

Office

Office Compatibility Pack

Office Web Apps

Sharepoint Server

Word For Mac

References · 5

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7291 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7291 · Vendor Advisory
• http://securitytracker.com/id/1037441 · Note
• http://securityfocus.com/bid/94671 · Note