KLA51714 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to spoof user interface, execute arbitrary code, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. A spoofing vulnerability in Visual Studio Tools for Office Runtime can be exploited remotely to spoof user interface.
2. A remote code execution vulnerability in Microsoft Office Visio can be exploited remotely to execute arbitrary code.
3. A spoofing vulnerability in Microsoft SharePoint Server can be exploited remotely to spoof user interface.
4. An information disclosure vulnerability in Microsoft SharePoint Server can be exploited remotely to obtain sensitive information.
5. A remote code execution vulnerability in Microsoft Outlook can be exploited remotely to execute arbitrary code.
6. A remote code execution vulnerability in Microsoft Teams can be exploited remotely to execute arbitrary code.
7. A remote code execution vulnerability in Microsoft Excel can be exploited remotely to execute arbitrary code.
8. A remote code execution vulnerability in Microsoft Office can be exploited remotely to execute arbitrary code.
9. A spoofing vulnerability in Microsoft Outlook can be exploited remotely to spoof user interface.

Original advisories

CVE-2023-36897

CVE-2023-35372

CVE-2023-36891

CVE-2023-36894

CVE-2023-36895

CVE-2023-36865

CVE-2023-36890

CVE-2023-29330

CVE-2023-36896

CVE-2023-35371

CVE-2023-29328

CVE-2023-36866

CVE-2023-36893

CVE-2023-36892

ADV230003

Related products

Microsoft-Office

Microsoft-Outlook

Microsoft-Excel

Microsoft-SharePoint

CVE list

CVE-2023-36897 high

CVE-2023-35372 critical

CVE-2023-36891 critical

CVE-2023-36894 high

CVE-2023-36895 critical

CVE-2023-36865 critical

CVE-2023-36890 high

CVE-2023-29330 critical

CVE-2023-36896 critical

CVE-2023-35371 critical

CVE-2023-29328 critical

CVE-2023-36866 critical

CVE-2023-36893 high

CVE-2023-36892 critical

KB list

5002453

5002459

5002437

5002435

5002422

5002464

5002451

5002445

5002398

5002436

5002463

5002449

5002462

5002391

5002439

5002328

4504720

4484489

5002417

5002418

5002399

5002465

5002565

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update component usually can be accessed from the Control Panel) and updates from the Update Options section, that are listed in your Office Account (Office Account tab usually can be accessed from the File menu)

Install Office updates

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft Office LTSC 2021 for 32-bit editionsMicrosoft Teams for AndroidMicrosoft Outlook 2013 Service Pack 1 (32-bit editions)Microsoft Office LTSC 2021 for 64-bit editionsMicrosoft Office Online ServerMicrosoft Office 2019 for 32-bit editionsMicrosoft Teams for MacMicrosoft Outlook 2013 RT Service Pack 1Microsoft Office 2013 Service Pack 1 (32-bit editions)Microsoft 365 Apps for Enterprise for 32-bit SystemsMicrosoft Office 2019 for MacMicrosoft 365 Apps for Enterprise for 64-bit SystemsMicrosoft SharePoint Enterprise Server 2016Microsoft Excel 2013 RT Service Pack 1Microsoft Office 2016 (32-bit edition)Microsoft Office 2016 (64-bit edition)Microsoft SharePoint Server 2019Microsoft Office 2013 RT Service Pack 1Microsoft Excel 2016 (64-bit edition)Microsoft Excel 2013 Service Pack 1 (64-bit editions)Microsoft Teams for iOSMicrosoft Excel 2013 Service Pack 1 (32-bit editions)Microsoft Teams for DesktopMicrosoft Excel 2016 (32-bit edition)Microsoft Outlook 2013 Service Pack 1 (64-bit editions)Microsoft SharePoint Server Subscription EditionMicrosoft Outlook 2016 (64-bit edition)Microsoft Office 2013 Service Pack 1 (64-bit editions)Microsoft Office 2019 for 64-bit editionsMicrosoft Office LTSC for Mac 2021Microsoft Outlook 2016 (32-bit edition)