MS15-110: Description of the security update for Office 2016 for Mac: October 13, 2015

None None...

Automattic: CSV Injection in polldaddy.com

Hello, We can inject commands in any fields of a member in an email group =210 for example, and when it's exported to CSV it will be evaluated to 20 in the corresponding cell, this enables an attacker to spread malware and execute system level commands on a victim's machine if the victim download...

Zaption: CSV Excel Macro Injection in Export Response

Scenario: An attacker creates a response like =AND21 in a tour that allows open response or discussion. Then when a user who created this tour clicks analytic and clicks to export responses as csv, he will see TRUE instead of =AND12 Meaning that cell is now active, and an attacker could make a...

Zendesk: CSV Excel Macro Injection Vulnerability in export chat logs

Scenario: An attacker creates a name as =AND21 with a fake email and with random text in the message body. This is similar to a vulnerability recently found in zendesk.com as well. When a team member clicks export as csv and opens it instead of seeing =AND21 they see TRUE. Meaning that cell is no...

Zendesk: CSV Excel Macro Injection Vulnerability in export customer tickets

Scenario: An attacker creates a name as =AND21 and creates a ticket. When a team member clicks export as csv and opens it instead of seeing =AND21 they see TRUE. This means that the cell is active. An attacker could basically attack makes a ticket, use -2+3+cmd|' /C calc'!E1 and could execute...

The vulnerabilities of Microsoft Excel editors, the Microsoft Office Compatibility Pack, and the Microsoft Excel Viewer allow a perpetrator to execute arbitrary code.

The vulnerability of Microsoft Excel editors, the Microsoft Office Compatibility Pack, and the Microsoft Excel Viewer are caused by buffer overflow attacks. Exploitation of this vulnerability can allow a malicious actor to execute arbitrary code using a specially crafted document...

The vulnerabilities of Microsoft Excel editors, the Microsoft Office Compatibility Pack, and the Microsoft Excel Viewer allow a perpetrator to execute arbitrary code.

The vulnerability of Microsoft Excel editors, the Microsoft Office Compatibility Pack, and the Microsoft Excel Viewer are caused by buffer overflow attacks. Exploitation of this vulnerability can allow a malicious actor to execute arbitrary code using a specially crafted document...

The vulnerabilities of Microsoft Excel editors, the Microsoft Office Compatibility Pack, and the Microsoft Excel Viewer allow a perpetrator to execute arbitrary code.

The vulnerability of Microsoft Excel editors, the Microsoft Office Compatibility Pack, and the Microsoft Excel Viewer are caused by buffer overflow attacks. Exploitation of this vulnerability can allow a malicious actor to execute arbitrary code using a specially crafted document...

Microsoft Office Excel 2007, 2010, 2013 - BIFFRecord Use-After-Free

CVE-ID：CVE-2015-2523受影响版本：Microsoft Office 2007Microsoft Office 2010Microsoft Office 2013Microsoft Office 2013 RT漏洞详情：The minimized crashing file shows two deltas from the original. The first at offset 0x237 is in the data of the 4th BIFFRecord and the second delta at offset 0x34a5 is in the type...

Microsoft Office 2007 - 'OGL.dll' ValidateBitmapInfo Bounds Check Failure (MS15-097)

Source: https://code.google.com/p/google-security-research/issues/detail?id=469 The following crash was observed in Microsoft Office 2007 Excel with Microsoft Office File Validation Add-In disabled and Application Verifier enabled for testing and reproduction. This bug did not reproduce in Office...

Microsoft Excel 2007/2010/2013 - BIFFRecord Use-After-Free

Source: https://code.google.com/p/google-security-research/issues/detail?id=462 The following crash was observed in Microsoft Excel 2007 running on Windows 2003 R2. This crash was also reproduced in Microsoft Excel 2010 on Windows 7 x86 and Microsoft Excel 2013 on Windows 8.1 x86. The test...

Microsoft Excel 200720102013 - BIFFRecord Use-After-Free

Microsoft Excel 200720102013 - BIFFRecord Use-After-Free Source: https://code.google.com/p/google-security-research/issues/detail?id=462 The following crash was observed in Microsoft Excel 2007 running on Windows 2003 R2. This crash was also reproduced in Microsoft Excel 2010 on Windows 7 x86 and...

CVE-2015-2523

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."...

CVE-2015-2521

Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."...

CVE-2015-2520

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."...

Memory corruption

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."...

Memory corruption

Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."...

Memory corruption

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."...

CVE-2015-2523

Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel for Mac 2011 and 2016, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."...

CVE-2015-2523

CVE-2015-2523 describes a memory corruption vulnerability in Microsoft Office components (notably Excel 2007 SP3, 2010 SP2, 2013 SP1/RT SP1, Mac 2011/2016, Office Compatibility Pack SP3, and Excel Viewer) that allows remote code execution when processing crafted Office documents. The root cause i...