Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA11551
HistorySep 10, 2019 - 12:00 a.m.

KLA11551 Multiple vulnerability in Microsoft Office

2019-09-1000:00:00
Kaspersky Lab
threats.kaspersky.com
55

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.042 Low

EPSS

Percentile

92.1%

JSON

Detect date:

09/10/2019

Severity:

Critical

Description:

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to spoof user interface, gain privileges, execute arbitrary code, bypass security restrictions, obtain sensitive information.

Exploitation:

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Affected products:

Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft SharePoint Server 2019
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Foundation 2010 Service Pack 2
Microsoft Office 2010 Service Pack 2 (32-bit editions)
Microsoft Office 2019 for 64-bit editions
Windows 10 Version 1809 for ARM64-based Systems
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Windows Server 2019 (Server Core installation)
Windows 10 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 8.1 for 32-bit systems
Windows Server 2016 (Server Core installation)
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows Server 2012
Windows 10 Version 1803 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows 10 Version 1803 for 32-bit Systems
Windows 10 Version 1709 for ARM64-based Systems
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server, version 1903 (Server Core installation)
Windows 8.1 for x64-based systems
Windows 10 Version 1703 for x64-based Systems
Office 365 ProPlus for 64-bit Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows 10 Version 1803 for x64-based Systems
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2012 R2 (Server Core installation)
Windows 10 Version 1709 for 32-bit Systems
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows 10 Version 1903 for x64-based Systems
Microsoft Office 2013 RT Service Pack 1
Windows Server 2008 for Itanium-Based Systems Service Pack 2
Microsoft Office 2019 for 32-bit editions
Windows Server 2012 (Server Core installation)
Windows Server, version 1803 (Server Core Installation)
Windows 10 Version 1903 for 32-bit Systems
Windows 10 Version 1809 for 32-bit Systems
Windows Server 2019
Microsoft Office 2010 Service Pack 2 (64-bit editions)
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows 10 Version 1703 for 32-bit Systems
Windows 10 Version 1709 for 64-based Systems
Office 365 ProPlus for 32-bit Systems
Microsoft Office 2016 (32-bit edition)
Windows RT 8.1
Windows Server 2016
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Windows Server 2012 R2
Windows 10 Version 1903 for ARM64-based Systems
Microsoft Office 2016 (64-bit edition)
Microsoft Project 2013 Service Pack 1 (32-bit editions)
Microsoft Project 2013 Service Pack 1 (64-bit editions)
Microsoft Project 2016 (32-bit edition)
Microsoft Project 2010 Service Pack 2 (32-bit editions)
Microsoft Project 2016 (64-bit edition)
Microsoft Project 2010 Service Pack 2 (64-bit editions)
Microsoft Lync Server 2013
Microsoft Excel 2016 (32-bit edition)
Microsoft Excel 2010 Service Pack 2 (32-bit editions)
Microsoft Office 2016 for Mac
Microsoft Excel 2016 (64-bit edition)
Microsoft Excel 2010 Service Pack 2 (64-bit editions)
Microsoft Excel 2013 RT Service Pack 1
Microsoft Office 2019 for Mac
Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft Excel 2013 Service Pack 1 (64-bit editions)

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2019-1261
CVE-2019-1260
CVE-2019-1257
CVE-2019-1262
CVE-2019-1246
CVE-2019-1295
CVE-2019-1264
CVE-2019-1296
CVE-2019-1209
CVE-2019-1263
CVE-2019-1259
CVE-2019-1297

Impacts:

ACE

Related products:

Microsoft Lync

CVE-IDS:

CVE-2019-12616.8High
CVE-2019-12604.0Warning
CVE-2019-12576.5High
CVE-2019-12623.5Warning
CVE-2019-12469.3Critical
CVE-2019-12956.5High
CVE-2019-12646.8High
CVE-2019-12966.5High
CVE-2019-12094.3Warning
CVE-2019-12634.3Warning
CVE-2019-12596.8High
CVE-2019-12979.3Critical

Microsoft official advisories:

KB list:

4484098
4475590
4475596
4475594
4464557
4484099
4475605
4475599
4475591
4475611
4461631
4464548
4464566
4475583
4475589
4475607
4515509
4475566
4475579
4475574

References

Related

mskb 35
nessus 20
openvas 24
cve 20
prion 20
mscve 12
checkpoint_advisories 4
zdi 5
symantec 12
exploitpack 1
cisa_kev 1
attackerkb 1
zeroscience 1
zdt 1
packetstorm 1
qualysblog 1
exploitdb 1
myhack58 1
talosblog 1
threatpost 1
kaspersky 2
mskb
mskb
Description of the security update for SharePoint Foundation 2013: September 10, 2019
2019-09-10 07:00:00
Description of the security update for SharePoint Server 2019: September 10, 2019
2019-09-10 07:00:00
Description of the security update for SharePoint Enterprise Server 2016: September 10, 2019
2019-09-10 07:00:00
nessus
nessus
Security Updates for Microsoft SharePoint Server (September 2019)
2019-09-13 00:00:00
Security Updates for Microsoft Office Products C2R (September 2019)
2022-06-10 00:00:00
Security Updates for Microsoft Office Products (September 2019)
2019-09-10 00:00:00
openvas
openvas
Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Sep 2019)
2019-09-11 00:00:00
Microsoft Excel 2010 Service Pack 2 Multiple Vulnerabilities (KB4475574)
2019-09-11 00:00:00
Microsoft Excel 2013 Service Pack 1 Multiple Vulnerabilities (KB4475566)
2019-09-11 00:00:00
cve
cve
CVE-2019-1296
2019-09-11 22:15:00
CVE-2019-1257
2019-09-11 22:15:00
CVE-2019-1295
2019-09-11 22:15:00
prion
prion
Remote code execution
2019-09-11 22:15:00
Remote code execution
2019-09-11 22:15:00
Remote code execution
2019-09-11 22:15:00
mscve
mscve
Microsoft SharePoint Spoofing Vulnerability
2019-09-10 07:00:00
Microsoft SharePoint Spoofing Vulnerability
2019-09-10 07:00:00
Microsoft SharePoint Remote Code Execution Vulnerability
2019-09-10 07:00:00
checkpoint_advisories
checkpoint_advisories
Microsoft SharePoint Remote Code Execution (CVE-2019-1295)
2019-09-10 00:00:00
Microsoft SharePoint Remote Code Execution (CVE-2019-1296)
2019-09-10 00:00:00
Microsoft SharePoint DestinationFolder Cross-site Scripting (CVE-2019-1262)
2019-12-22 00:00:00
zdi
zdi
Microsoft SharePoint Business Data Connectivity Service Deserialization of Untrusted Data Remote Code Execution Vulnerability
2019-09-10 00:00:00
Microsoft SharePoint Business Data Connectivity Service Deserialization of Untrusted Data Remote Code Execution Vulnerability
2019-09-10 00:00:00
Microsoft SharePoint Business Data Connectivity Service Deserialization of Untrusted Data Remote Code Execution Vulnerability
2019-09-10 00:00:00
symantec
symantec
Microsoft SharePoint CVE-2019-1259 Spoofing Vulnerability
2019-09-10 00:00:00
Microsoft SharePoint CVE-2019-1261 Spoofing Vulnerability
2019-09-10 00:00:00
Microsoft SharePoint CVE-2019-1257 Remote Code Execution Vulnerability
2019-09-10 00:00:00
exploitpack
exploitpack
Microsoft SharePoint 2013 SP1 - DestinationFolder Persistant Cross-Site Scripting
2019-09-25 00:00:00
cisa_kev
cisa_kev
Microsoft Excel Remote Code Execution Vulnerability
2022-03-03 00:00:00
attackerkb
attackerkb
CVE-2019-1297
2019-09-11 00:00:00
zeroscience
zeroscience
Microsoft SharePoint 2013 SP1 Stored XSS Vulnerability
2019-09-24 00:00:00
zdt
zdt
Microsoft SharePoint 2013 SP1 - (DestinationFolder) Persistant Cross-Site Scripting Vulnerability
2019-09-25 00:00:00
packetstorm
packetstorm
Microsoft SharePoint 2013 SP1 Cross Site Scripting
2019-09-24 00:00:00
qualysblog
qualysblog
September Patch Tuesday – 79 Vulns, 17 Critical, Remote Desktop Client, SharePoint, Exploited PrivEsc
2019-09-10 18:00:37
exploitdb
exploitdb
Microsoft SharePoint 2013 SP1 - 'DestinationFolder' Persistant Cross-Site Scripting
2019-09-25 00:00:00
myhack58
myhack58
RTOS VxWorks multiple high-risk vulnerability alerts-a vulnerability alert-the black bar safety net
2019-08-01 00:00:00
talosblog
talosblog
Microsoft Patch Tuesday — Sept. 2019: Vulnerability disclosures and Snort coverage
2019-09-10 12:12:34
threatpost
threatpost
Microsoft Addresses Two Zero-Days Under Active Attack
2019-09-10 19:54:07
kaspersky
kaspersky
KLA11555 Multiple vulnerabilities in Microsoft Products (ESU)
2019-09-10 00:00:00
KLA11552 Multiple vulnerabilities in Microsoft Windows
2019-09-10 00:00:00

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.8 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.042 Low

EPSS

Percentile

92.1%

JSON
Related for KLA11551
mskb35nessus20openvas24cve20prion20mscve12checkpoint_advisories4zdi5symantec12exploitpack1cisa_kev1attackerkb1zeroscience1zdt1packetstorm1qualysblog1exploitdb1myhack581talosblog1threatpost1kaspersky2