PT-2018-18548 · Microsoft · Office Word+2

Jonathan Birch · Published 2018-07-10 · Updated 2020-08-24 · CVE-2018-8310

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Outlook (affected versions not specified) Microsoft Word (affected versions not specified) Microsoft Office (affected versions not specified)

Description A tampering issue exists due to improper handling of specific attachment types when rendering HTML emails. An attacker could exploit this by sending a specially crafted email and attachment to a victim, or by hosting a malicious .eml file on a web server. Successful exploitation could allow embedding untrusted TrueType fonts in an email, potentially leading to further system compromise when combined with other exploits.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2018-8310

Affected Products

Office

Outlook

Office Word

References · 6

• https://osv.dev/vulnerability/CVE-2018-8310 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8310 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8310 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8310 · Security Note
• http://securityfocus.com/bid/104615 · Note
• http://securitytracker.com/id/1041274 · Note