Security Updates for Microsoft Word Products (February 2024)

The Microsoft Word Products are missing security updates. They are, therefore, affected by multiple remote code execution vulnerabilities. An attacker can exploit these to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for these issues but has...

CVE-2024-20709

Acrobat Reader T5 MSFT Edge versions 120.0.2210.91 and earlier are affected by an Improper Input Validation vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue...

Input validation

Acrobat Reader T5 MSFT Edge versions 120.0.2210.91 and earlier are affected by an Improper Input Validation vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue...

Input validation

Acrobat Reader T5 MSFT Edge versions 120.0.2210.91 and earlier are affected by an Improper Input Validation vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue...

CVE-2024-20709

CVE-2024-20709 describes an Improper Input Validation in Acrobat Reader T5 (MSFT Edge) affecting versions

CVE-2024-20721 T5 Acrobat JS vulnerability - Exploitable crash via t5::javascript::get_page_num_words

Acrobat Reader T5 MSFT Edge versions 120.0.2210.91 and earlier are affected by an Improper Input Validation vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue...

CVE-2024-20721

CVE-2024-20721 affects Acrobat Reader T5 (MSFT Edge) versions 120.0.2210.91 and earlier. The root cause is improper input validation. In the described vulnerability, an unauthenticated attacker can cause an application DoS in the context of the current user, with exploitation requiring user inter...

AZL-32103 CVE-2023-45285 affecting package msft-golang for versions less than 1.22.3-1.

Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module...

AZL-32123 CVE-2023-45287 affecting package msft-golang for versions less than 1.20.0-1

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS1 padding may leak timing...

CVE-2023-24540 affecting package msft-golang for versions less than 1.20.11-1

CVE-2023-24540 affecting package msft-golang for versions less than 1.20.11-1. A patched version of the package is available...

CVE-2023-24536 affecting package msft-golang for versions less than 1.20.7-1

CVE-2023-24536 affecting package msft-golang for versions less than 1.20.7-1. A patched version of the package is available...

CVE-2023-24534 affecting package msft-golang for versions less than 1.20.7-1

CVE-2023-24534 affecting package msft-golang for versions less than 1.20.7-1. A patched version of the package is available...

CVE-2023-29400 affecting package msft-golang for versions less than 1.20.7-1

CVE-2023-29400 affecting package msft-golang for versions less than 1.20.7-1. A patched version of the package is available...

CVE-2023-24538 affecting package msft-golang for versions less than 1.20.11-1

CVE-2023-24538 affecting package msft-golang for versions less than 1.20.11-1. A patched version of the package is available...

CVE-2023-45283 affecting package msft-golang for versions less than 1.20.11-1

CVE-2023-45283 affecting package msft-golang for versions less than 1.20.11-1. A patched version of the package is available...

CVE-2023-29403 affecting package msft-golang for versions less than 1.20.7-1

CVE-2023-29403 affecting package msft-golang for versions less than 1.20.7-1. A patched version of the package is available...

CVE-2023-29405 affecting package msft-golang for versions less than 1.20.7-1

CVE-2023-29405 affecting package msft-golang for versions less than 1.20.7-1. A patched version of the package is available...

CVE-2023-24537 affecting package msft-golang for versions less than 1.20.11-1

CVE-2023-24537 affecting package msft-golang for versions less than 1.20.11-1. A patched version of the package is available...

CVE-2023-29409 affecting package msft-golang for versions less than 1.20.7-1

CVE-2023-29409 affecting package msft-golang for versions less than 1.20.7-1. A patched version of the package is available...

CVE-2023-39318 affecting package msft-golang for versions less than 1.20.10-1

CVE-2023-39318 affecting package msft-golang for versions less than 1.20.10-1. A patched version of the package is available...