PT-2019-1164 · Microsoft · Office Online Server+6

Published 2019-01-08 · Updated 2020-08-24 · CVE-2019-0585

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Word (affected versions not specified) Microsoft Office (affected versions not specified) Microsoft Office Word Viewer (affected versions not specified) Office 365 ProPlus (affected versions not specified) Microsoft SharePoint (affected versions not specified) Microsoft Office Online Server (affected versions not specified) Microsoft SharePoint Server (affected versions not specified) Office Web Apps Server (affected versions not specified) SharePoint Enterprise Server (affected versions not specified)

Description: A remote code execution issue exists due to improper handling of objects in memory. This could allow a remote attacker to execute arbitrary code using a specially crafted file, performing actions in the security context of the current user.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2019-00208

CVE-2019-0585

ZDI-19-054

Affected Products

Office

Office Online Server

Office Word Viewer

Sharepoint Server

Office Word

Office 365 Proplus

Office Web Apps Server

References · 7

• https://bdu.fstec.ru/vul/2019-00208 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-054 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0585 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0585 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0585 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0585 · Vendor Advisory
• http://securityfocus.com/bid/106392 · Note