Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA10874
HistorySep 13, 2016 - 12:00 a.m.

KLA10874 Multiple vulnerabilities in Microsoft Office

2016-09-1300:00:00
Kaspersky Lab
threats.kaspersky.com
144

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.273 Low

EPSS

Percentile

96.7%

JSON

Detect date:

09/13/2016

Severity:

High

Description:

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to bypass security restrictions, spoof user interface, execute arbitrary code or obtain sensitive information.

Affected products:

Microsoft Office 2007 Service Pack 3
Microsoft Office 2010 Service Pack 2
Microsoft Office 2013 Service Pack 1
Microsoft Office 2013 RT Service Pack 1
Microsoft Office 2016
Microsoft Office for Mac 2011
Microsoft Office 2016 for Mac
Microsoft Office Compatibility Pack Service Pack 3
Microsoft Excel, PowerPoint and Word Viewers
Microsoft SharePoint Server 2007 Service Pack 3
Microsoft SharePoint Server 2010 Service Pack 2
Microsoft SharePoint Server 2013 ServicePack 1
Microsoft Office Web Apps 2010 Service Pack 2
Microsoft Office Web Apps 2013 Service Pack 1
Office Online Server

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2016-3362
CVE-2016-3363
CVE-2016-3364
CVE-2016-3365
CVE-2016-3366
CVE-2016-3358
CVE-2016-0137
CVE-2016-0141
CVE-2016-3357
CVE-2016-3381
CVE-2016-3359
CVE-2016-3360
CVE-2016-3361

Impacts:

ACE

Related products:

Microsoft Office

CVE-IDS:

CVE-2016-33629.3Critical
CVE-2016-33639.3Critical
CVE-2016-33649.3Critical
CVE-2016-33659.3Critical
CVE-2016-33664.3Warning
CVE-2016-33589.3Critical
CVE-2016-01374.3Warning
CVE-2016-01414.3Warning
CVE-2016-33579.3Critical
CVE-2016-33819.3Critical
CVE-2016-33599.3Critical
CVE-2016-33609.3Critical
CVE-2016-33619.3Critical

Microsoft official advisories:

KB list:

3118270
3115459
3118299
3118290
3118292
3118293
3115472
3118297
3115169
3118316
3114744
3118313
3115487
2597974
3054862
2553432
3115462
3115463
3115119
3115466
3115467
3115443
3115112
3054969
3118284
3186807
3186805
3118280
3118303
3118300
3118268
3118309

Exploitation:

Public exploits exist for this vulnerability.

References

Related

nessus 2
mskb 33
openvas 12
cve 13
prion 13
symantec 11
mscve 13
checkpoint_advisories 9
srcincite 4
zdt 1
zdi 1
threatpost 1
nessus
nessus
MS16-107: Security Update for Microsoft Office (3185852)
2016-09-14 00:00:00
MS16-107: Security Update for Microsoft Office (3185852) (Mac OS X)
2016-09-15 00:00:00
mskb
mskb
MS16-107: Security update for Microsoft Office: September 13, 2016
2016-09-13 00:00:00
MS16-107: Description of the security update for Excel 2010: September 13, 2016
2016-09-13 07:00:00
Security update 2016-09-13
2016-09-13 07:00:00
openvas
openvas
Microsoft Office Compatibility Pack Multiple RCE Vulnerabilities (3185852)
2016-09-14 00:00:00
Microsoft Windows Excel Viewer Remote Code Execution Vulnerabilities (3185852)
2016-09-14 00:00:00
MS SharePoint Server Excel Services Multiple Remote Code Execution Vulnerabilities (3115112)
2016-09-14 00:00:00
cve
cve
CVE-2016-3363
2016-09-14 10:59:00
CVE-2016-3362
2016-09-14 10:59:00
CVE-2016-3381
2016-09-14 10:59:00
prion
prion
Memory corruption
2016-09-14 10:59:00
Memory corruption
2016-09-14 10:59:00
Memory corruption
2016-09-14 10:59:00
symantec
symantec
Microsoft Office CVE-2016-3366 Spoofing Vulnerability
2016-09-13 00:00:00
Microsoft Office CVE-2016-3360 Memory Corruption Vulnerability
2016-09-13 00:00:00
Microsoft Office CVE-2016-3361 Memory Corruption Vulnerability
2016-09-13 00:00:00
mscve
mscve
Microsoft Outlook Spoofing Vulnerability
2016-09-13 07:00:00
Microsoft Office Memory Corruption Vulnerability
2016-09-13 07:00:00
Microsoft Office Memory Corruption Vulnerability
2016-09-13 07:00:00
checkpoint_advisories
checkpoint_advisories
Microsoft Office Memory Corruption (MS16-107: CVE-2016-3360)
2016-09-13 00:00:00
Microsoft Office Memory Corruption (MS16-107: CVE-2016-3364)
2016-09-13 00:00:00
Microsoft Office Memory Corruption (MS16-107: CVE-2016-3359)
2016-09-13 00:00:00
srcincite
srcincite
SRC-2016-0040 : Microsoft Office Excel Binary Worksheet Use-After-Free Remote Code Execution Vulnerability
2016-06-29 00:00:00
SRC-2016-0037 : Microsoft Office Excel Binary Worksheet Use-After-Free Remote Code Execution Vulnerability
2016-06-29 00:00:00
SRC-2016-0036 : Microsoft Office Excel Binary Worksheet Use-After-Free Remote Code Execution Vulnerability
2016-06-29 00:00:00
zdt
zdt
Microsoft Office PowerPoint 2010 - Invalid Pointer Reference
2016-09-21 00:00:00
zdi
zdi
Microsoft Office Excel Art Data Memory Corruption Remote Code Execution Vulnerability
2016-09-16 00:00:00
threatpost
threatpost
Microsoft Fixes 47 Vulnerabilities with September Patch Tuesday
2016-09-13 16:24:13

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.273 Low

EPSS

Percentile

96.7%

JSON
Related for KLA10874
nessus2mskb33openvas12cve13prion13symantec11mscve13checkpoint_advisories9srcincite4zdt1zdi1threatpost1