PT-2017-2334 · Microsoft · Office+1

Published 2017-06-13 · Updated 2019-10-03 · CVE-2017-8510

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office (affected versions not specified) Microsoft Excel (affected versions not specified)

Description The issue is related to improper handling of objects in memory, which can be exploited by a remote attacker to execute arbitrary code. This can be achieved by using a specially crafted file, allowing the attacker to perform actions in the security context of the current user. The exploitation requires a user to open the specially crafted file with an affected version of Microsoft Office software.

Recommendations For Microsoft Office, update to a version that properly handles objects in memory to prevent exploitation. For Microsoft Excel, consider avoiding the use of specially crafted files until a patch is available. As a temporary workaround, consider restricting access to files from untrusted sources to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-19

Related Identifiers

BDU:2017-01532

CVE-2017-8510

Affected Products

Office Excel

Office

References · 6

• https://osv.dev/vulnerability/CVE-2017-8510 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8510 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8510 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01532 · Security Note
• http://securityfocus.com/bid/98813 · Note
• http://securitytracker.com/id/1038668 · Note