Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, Office Web Apps Server 2013 SP1, and Office Online Server allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities in Microsoft Office :

  - Multiple remote code execution vulnerabilities exist due     to improper handling of objects in memory.  An     unauthenticated, remote attacker can exploit these by     convincing a user to open a specially crafted file or     visit a website that hosts such a file, resulting in the     execution of arbitrary code in the context of the user.
    (CVE-2016-0025, CVE-2016-3233)

  - A flaw exists due to improper disclosure of memory     contents. An unauthenticated, remote attacker can     exploit this by convincing a user to open a specially     crafted file, resulting in the disclosure of potentially     sensitive information. (CVE-2016-3234)

  - A flaw exists due to improper validation of input     before loading OLE library files. A local attacker can     exploit this, via a specially crafted application, to     execute arbitrary code. (CVE-2016-3235)

The version of Microsoft Office installed on the remote Mac OS X host is affected by a remote code execution vulnerability due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this by convincing a user to open a specially crafted file or visit a website that hosts such a file, resulting in the execution of arbitrary code in the context of the current user.

ID	Name	Product	Family	Severity
91611	MS16-070: Security Update for Microsoft Office (3163610)	Nessus	Windows : Microsoft Bulletins	high
91610	MS16-070: Security Update for Microsoft Office (3163610) (Mac OS X)	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2016-0025

high

Tenable Plugins

high

high