KLA11663 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, bypass security restrictions.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in Microsoft Excel can be exploited remotely via specially crafted file to execute arbitrary code.
2. A cross-site-scripting (XSS) vulnerability Microsoft Office SharePoint can be exploited remotely via specially crafted web to spoof user interface.
3. A security feature bypass vulnerability in Microsoft Outlook can be exploited remotely via specially crafted to bypass security restrictions.
4. A tampering vulnerability in Microsoft Office can be exploited remotely via specially crafted file to spoof user interface.
5. A spoofing vulnerability in Microsoft Office Online Server can be exploited remotely via specially crafted request to spoof user interface.

Original advisories

CVE-2020-0759

CVE-2020-0693

CVE-2020-0696

CVE-2020-0697

CVE-2020-0694

CVE-2020-0695

Related products

Microsoft-Office

Microsoft-Outlook

Microsoft-Excel

CVE list

CVE-2020-0759 critical

CVE-2020-0693 warning

CVE-2020-0696 warning

CVE-2020-0697 high

CVE-2020-0694 warning

CVE-2020-0695 high

KB list

4484265

4484254

4484264

4484255

4484259

4484156

4484163

4484267

4484256

4484250

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft Excel 2016 (32-bit edition)Microsoft Outlook 2013 Service Pack 1 (32-bit editions)Microsoft Excel 2016 (64-bit edition)Microsoft Outlook 2010 Service Pack 2 (32-bit editions)Microsoft Outlook 2013 Service Pack 1 (64-bit editions)Office Online ServerMicrosoft SharePoint Enterprise Server 2016Microsoft SharePoint Server 2019Microsoft Excel 2010 Service Pack 2 (32-bit editions)Office 365 ProPlus for 32-bit SystemsMicrosoft Outlook 2016 (64-bit edition)Microsoft Excel 2010 Service Pack 2 (64-bit editions)Office 365 ProPlus for 64-bit SystemsMicrosoft SharePoint Server 2013 Service Pack 1Microsoft Excel 2013 RT Service Pack 1Microsoft Office 2019 for 64-bit editionsMicrosoft Excel 2013 Service Pack 1 (64-bit editions)Microsoft Office 2019 for 32-bit editionsMicrosoft Excel 2013 Service Pack 1 (32-bit editions)Microsoft Outlook 2010 Service Pack 2 (64-bit editions)Microsoft Office 2019 for MacMicrosoft Outlook 2016 (32-bit edition)Microsoft Outlook 2013 RT Service Pack 1Microsoft Office 2016 for Mac