PT-2017-10455 · Microsoft · Office Compatibility Pack+2

Published 2017-04-11 · Updated 2017-07-11 · CVE-2017-0194

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Excel versions 2007 SP3 through 2010 SP2 Office Compatibility Pack version SP2

Description The issue allows remote attackers to obtain sensitive information from process memory via a crafted Office document. This is related to improper disclosure of the contents of Microsoft Office memory, which could be used to compromise the user's computer or data.

Recommendations For Microsoft Excel 2007 SP3, update to a version that fixes the information disclosure issue. For Microsoft Excel 2010 SP2, update to a version that fixes the information disclosure issue. For Office Compatibility Pack SP2, update to a version that fixes the information disclosure issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-0194

Affected Products

Office Excel

Office

Office Compatibility Pack

References · 5

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0194 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0194 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0194 · Security Note
• http://securityfocus.com/bid/97436 · Note
• http://securitytracker.com/id/1038244 · Note