KLA73225 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, obtain sensitive information, bypass security restrictions, cause denial of service.

Below is a complete list of vulnerabilities:

1. An elevation of privilege vulnerability in Microsoft Excel can be exploited remotely to gain privileges.
2. A remote code execution vulnerability in Microsoft Office Visio can be exploited remotely to execute arbitrary code.
3. An elevation of privilege vulnerability in Windows Graphics Component can be exploited remotely to gain privileges.
4. A remote code execution vulnerability in Microsoft SharePoint Server can be exploited remotely to execute arbitrary code.
5. An information disclosure vulnerability in Microsoft Outlook for iOS can be exploited remotely to obtain sensitive information.
6. A security feature bypass vulnerability in Microsoft Publisher can be exploited remotely to bypass security restrictions.
7. An elevation of privilege vulnerability in Microsoft AutoUpdate (MAU) can be exploited remotely to gain privileges.
8. A denial of service vulnerability in Microsoft SharePoint Server can be exploited remotely to cause denial of service.

Original advisories

CVE-2024-43465

CVE-2024-43463

CVE-2024-38250

CVE-2024-38018

CVE-2024-43464

CVE-2024-43482

CVE-2024-38226

CVE-2024-43492

CVE-2024-38227

CVE-2024-38228

CVE-2024-43466

Related products

Microsoft-Office

Microsoft-Outlook

Microsoft-Excel

Microsoft-SharePoint

CVE list

CVE-2024-38250 critical

CVE-2024-43465 critical

CVE-2024-43463 critical

CVE-2024-38018 critical

CVE-2024-43464 high

CVE-2024-43482 high

CVE-2024-38226 high

CVE-2024-43492 critical

CVE-2024-38227 high

CVE-2024-38228 high

CVE-2024-43466 high

KB list

5002640

5002634

5002639

5002566

5002605

5002624

5002601

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update component usually can be accessed from the Control Panel) and updates from the Update Options section, that are listed in your Office Account (Office Account tab usually can be accessed from the File menu)

Install Office updates

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Microsoft Office 2019 for 32-bit editionsMicrosoft Publisher 2016 (64-bit edition)Microsoft SharePoint Server 2019Microsoft Office LTSC for Mac 2021Microsoft Excel 2016 (32-bit edition)Microsoft Office for UniversalMicrosoft Publisher 2016 (32-bit edition)Microsoft 365 Apps for Enterprise for 64-bit SystemsMicrosoft Excel 2016 (64-bit edition)Microsoft Office 2019 for 64-bit editionsOutlook for iOSMicrosoft Office LTSC 2021 for 32-bit editionsMicrosoft 365 Apps for Enterprise for 32-bit SystemsMicrosoft Office LTSC 2021 for 64-bit editionsMicrosoft SharePoint Server Subscription EditionMicrosoft Office for AndroidMicrosoft AutoUpdate for MacMicrosoft Visio 2016 (64-bit edition)Microsoft Visio 2016 (32-bit edition)Microsoft SharePoint Enterprise Server 2016Microsoft Office Online Server