Microsoft Corporation Office
At a glance
- Source
- NVD
- EPSS
- EPSS 25.99 % · percentile 98 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- microsoft
- NVD status
- Modified
Description
Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Office Web Apps Server 2010 SP2, Word 2007 SP3, Word 2010 SP2, and Word Automation Services on SharePoint Server 2010 SP2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0006, CVE-2017-0019, CVE-2017-0020, CVE-2017-0031, CVE-2017-0052, and CVE-2017-0053.
Weaknesses (CWE)
- CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2017-0397
- GCVE · GCVE-0-2017-0030
CERT-FR advisories
- CERTFR-2017-AVI-081 — Multiples vulnérabilités dans Microsoft Office · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:*cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Microsoft Corporation · Office | affected Office 2010 SP2, Office Compatibility Pack SP3, Office Web Apps Server 2010 SP2, Word 2007 SP3, Word 2010 SP2, and Word Automation Services on SharePoint Server 2010 SP2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |