Kaspersky LabKLA11950KLA11950 Multiple vulnerabilities in Microsoft Office
9.9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
8.3 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.044 Low
EPSS
Percentile
92.3%
Detect date:
09/08/2020
Severity:
Critical
Description:
Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface, obtain sensitive information, gain privileges.
Affected products:
Microsoft Office 2019 for 64-bit editions
Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft Office 2010 Service Pack 2 (64-bit editions)
Microsoft Word 2013 Service Pack 1 (32-bit editions)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft Excel 2013 Service Pack 1 (64-bit editions)
Microsoft Excel 2016 (32-bit edition)
Microsoft Office 2016 for Mac
Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft Office Web Apps 2013 Service Pack 1
Microsoft Office 2013 RT Service Pack 1
Microsoft Excel 2013 RT Service Pack 1
Microsoft SharePoint Server 2010 Service Pack 2
Microsoft Word 2010 Service Pack 2 (32-bit editions)
Microsoft Office 2019 for 32-bit editions
Microsoft Office 2016 (32-bit edition)
Microsoft Office 2016 (64-bit edition)
Microsoft Office 2019 for Mac
Microsoft Office Online Server
Microsoft Word 2013 RT Service Pack 1
Microsoft Word 2010 Service Pack 2 (64-bit editions)
Microsoft SharePoint Enterprise Server 2016
Microsoft SharePoint Foundation 2010 Service Pack 2
Microsoft SharePoint Foundation 2013 Service Pack 1
OneDrive for Windows
Microsoft Excel 2010 Service Pack 2 (32-bit editions)
Microsoft Word 2016 (64-bit edition)
Microsoft Excel 2010 Service Pack 2 (64-bit editions)
Microsoft Office 2010 Service Pack 2 (32-bit editions)
Microsoft Business Productivity Servers 2010 Service Pack 2
Microsoft SharePoint Server 2019
Microsoft Word 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft Excel 2016 (64-bit edition)
Microsoft Word 2016 (32-bit edition)
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft Office Web Apps 2010 Service Pack 2
Solution:
Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories:
CVE-2020-1452
CVE-2020-1345
CVE-2020-1224
CVE-2020-1227
CVE-2020-1200
CVE-2020-1595
CVE-2020-1205
CVE-2020-1453
CVE-2020-1575
CVE-2020-1576
CVE-2020-16851
CVE-2020-1193
CVE-2020-16852
CVE-2020-1514
CVE-2020-1594
CVE-2020-16855
CVE-2020-1198
CVE-2020-1482
CVE-2020-16853
CVE-2020-1210
CVE-2020-1338
CVE-2020-1440
CVE-2020-1218
CVE-2020-1335
CVE-2020-1332
CVE-2020-1460
CVE-2020-1523
Impacts:
ACE
Related products:
CVE-IDS:
CVE-2020-14528.6Critical
CVE-2020-13457.4High
CVE-2020-12245.5High
CVE-2020-12275.4High
CVE-2020-12008.6Critical
CVE-2020-15959.9Critical
CVE-2020-12054.6Warning
CVE-2020-14538.6Critical
CVE-2020-15755.4High
CVE-2020-15768.5Critical
CVE-2020-168517.1High
CVE-2020-11937.8Critical
CVE-2020-168527.1High
CVE-2020-15145.4High
CVE-2020-15947.8Critical
CVE-2020-168555.5High
CVE-2020-11987.4High
CVE-2020-14826.3High
CVE-2020-168537.1High
CVE-2020-12109.9Critical
CVE-2020-13387.8Critical
CVE-2020-14406.3High
CVE-2020-12187.8Critical
CVE-2020-13357.8Critical
CVE-2020-13327.8Critical
CVE-2020-14608.6Critical
CVE-2020-15238.9Critical
KB list:
4484533
4484503
4486660
4486667
4484515
4484530
4484512
4484506
4484469
4486665
4484504
4486661
4484522
4484526
4484510
4484518
4484528
4484480
3101523
4484513
4484517
4486664
4484525
4484514
4484505
4484516
4484507
4484488
4484466
4484532
Microsoft official advisories:
References
support.microsoft.com/kb/3101523
support.microsoft.com/kb/4484466
support.microsoft.com/kb/4484469
support.microsoft.com/kb/4484480
support.microsoft.com/kb/4484488
support.microsoft.com/kb/4484503
support.microsoft.com/kb/4484504
support.microsoft.com/kb/4484505
support.microsoft.com/kb/4484506
support.microsoft.com/kb/4484507
support.microsoft.com/kb/4484510
support.microsoft.com/kb/4484512
support.microsoft.com/kb/4484513
support.microsoft.com/kb/4484514
support.microsoft.com/kb/4484515
support.microsoft.com/kb/4484516
support.microsoft.com/kb/4484517
support.microsoft.com/kb/4484518
support.microsoft.com/kb/4484522
support.microsoft.com/kb/4484525
support.microsoft.com/kb/4484526
support.microsoft.com/kb/4484528
support.microsoft.com/kb/4484530
support.microsoft.com/kb/4484532
support.microsoft.com/kb/4484533
support.microsoft.com/kb/4486660
support.microsoft.com/kb/4486661
support.microsoft.com/kb/4486664
support.microsoft.com/kb/4486665
support.microsoft.com/kb/4486667
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1193
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1198
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1200
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1205
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1210
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1218
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1224
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1227
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1332
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1335
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1338
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1345
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1440
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1452
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1453
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1460
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1482
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1514
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1523
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1575
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1576
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1594
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1595
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16851
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16852
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16853
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16855
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1193
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1198
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1200
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1205
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1210
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1218
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1224
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1227
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1332
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1335
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1338
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1345
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1440
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1452
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1453
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1460
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1482
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1514
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1523
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1575
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1576
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1594
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-1595
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-16851
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-16852
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-16853
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2020-16855
portal.msrc.microsoft.com/en-us/security-guidance
statistics.securelist.com/vulnerability-scan/month
threats.kaspersky.com/en/product/Microsoft-Excel/
threats.kaspersky.com/en/product/Microsoft-Office/
threats.kaspersky.com/en/product/Microsoft-Windows/
threats.kaspersky.com/en/product/Microsoft-Word/
Related
9.9 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
8.3 High
AI Score
Confidence
High
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.044 Low
EPSS
Percentile
92.3%