Microsoft Office CVE-2019-1402 Local Information Disclosure Vulnerability

Description

Microsoft Office is prone to a local information-disclosure vulnerability. A local attacker can leverage this issue to obtain sensitive information that may aid in further attacks.

Technologies Affected

• Microsoft Office 2010 (32-bit edition) SP2
• Microsoft Office 2010 (64-bit edition) SP2
• Microsoft Office 2013 RT Service Pack 1
• Microsoft Office 2013 Service Pack 1 (32-bit editions)
• Microsoft Office 2013 Service Pack 1 (64-bit editions)
• Microsoft Office 2016 (32-bit edition)
• Microsoft Office 2016 (64-bit edition)
• Microsoft Office 2019 for 32-bit editions
• Microsoft Office 2019 for 64-bit editions
• Microsoft Office 365 ProPlus for 32-bit Systems
• Microsoft Office 365 ProPlus for 64-bit Systems

Recommendations

Permit local access for trusted individuals only. Where possible, use restricted environments and restricted shells.
Ensure that only trusted users have local, interactive access to affected computers.

Updates are available. Please see the references or vendor advisory for more information.