PT-2019-1137 · Microsoft · Office 365 Proplus+2

Published 2019-01-08 · Updated 2020-08-24 · CVE-2019-0559

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Office versions (affected versions not specified) Office 365 ProPlus (affected versions not specified) Microsoft Outlook (affected versions not specified)

Description: The issue is related to an information disclosure problem due to improper handling of certain message types by Microsoft Outlook. This could allow a remote attacker to gather information about the victim using a specially crafted email message.

Recommendations: For Microsoft Office, update to a version that includes the fix for this issue. For Office 365 ProPlus, apply the necessary patch or update to resolve the vulnerability. For Microsoft Outlook, consider disabling the handling of certain message types until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2019-00163

CVE-2019-0559

Affected Products

Office

Outlook

Office 365 Proplus

References · 5

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0559 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0559 · Security Note
• https://bdu.fstec.ru/vul/2019-00163 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0559 · Vendor Advisory
• http://securityfocus.com/bid/106397 · Note