Microsoft Corporation Microsoft Office
At a glance
- Source
- NVD
- EPSS
- EPSS 15.76 % · percentile 97 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- microsoft
- NVD status
- Modified
Description
Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web Apps 2013 SP1, Project Server 2013 SP1, SharePoint Enterprise Server 2013 SP1, SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, Sharepoint Server 2010 SP2, Word 2016, and Skype for Business 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka "Office Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-0261 and CVE-2017-0262.
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2017-0637
- GCVE · GCVE-0-2017-0281
CERT-FR advisories
- CERTFR-2017-AVI-147 — Multiples vulnérabilités dans Microsoft Office · cert.ssi.gouv.fr
- CERTFR-2017-AVI-145 — Vulnérabilités dans Microsoft Skype for Business 2016 · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*cpe:2.3:a:microsoft:office_online_server:2016:*:*:*:*:*:*:*cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:*cpe:2.3:a:microsoft:office_web_apps:2013:sp1:*:*:*:*:*:*cpe:2.3:a:microsoft:project_server:2013:sp1:*:*:*:*:*:*cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:*:*:*:*:*:*cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:*:*:*:*cpe:2.3:a:microsoft:skype_for_business:2016:*:*:*:*:*:*:*cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Microsoft Corporation · Microsoft Office | affected Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web Apps 2013 SP1, Project Server 2013 SP1, SharePoint Enterprise Server 2013 SP1, SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, Sharepoint Server 2010 SP2, Word 2016, and Skype for Business 2016. |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |