98101

1038443

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0254

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by a remote code execution vulnerability due to a failure to properly handle objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted Office document or visit a specially crafted website, to execute arbitrary code in the context of the current user.

The Microsoft Office application, Office Web Apps, or SharePoint Server installed on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in     Microsoft Office software due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit this, by convincing a user to open a     specially crafted Office document, to execute arbitrary     code in the context of the current user. (CVE-2017-0254)

  - A cross-site scripting (XSS) vulnerability exists in     Microsoft SharePoint Server due improper validation of     user-supplied input in web requests. An unauthenticated,     remote attacker can exploit this, via a specially     crafted request, to execute arbitrary script code in a     user's browser session. (CVE-2017-0255)

  - A remote code execution vulnerability exists in     Microsoft Office due to improper handling of malformed     graphics images. An unauthenticated, remote attacker can     exploit this, by convincing a user to open a specially     crafted EPS file, to execute arbitrary code in the     context of the current user. (CVE-2017-0261)

  - A remote code execution vulnerability exists in     Microsoft Office when handling malformed graphics     images. An unauthenticated, remote attacker can exploit     this, by convincing a user to open a specially crafted     EPS file or visit a specially crafted website, to     execute arbitrary code. (CVE-2017-0262)

  - A remote code execution vulnerability exists in     Microsoft Office due to improper handling of objects in     memory. An unauthenticated, remote attacker can exploit     this, by convincing a user to open a specially crafted     file, to execute arbitrary code in the context of the     current user. (CVE-2017-0281)

ID	Name	Product	Family	Severity
100295	Security Update for Microsoft Office (May 2017) (macOS)	Nessus	MacOS X Local Security Checks	high
100103	Security Update for Microsoft Office Products (May 2017)	Nessus	Windows : Microsoft Bulletins	high

CVE-2017-0254

high

Tenable Plugins

high

high