Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Office handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0852.

The Microsoft Word Viewer application installed on the remote host is missing a security update.
It is, therefore, affected by the following vulnerability :

  - A remote code execution vulnerability exists in     Microsoft Office software when the Office software fails     to properly handle objects in memory. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2018-0851)

The Microsoft Office Products are missing security updates.
It is, therefore, affected by the following vulnerabilities :

  - A remote code execution vulnerability exists in     Microsoft Office software when the Office software fails     to properly handle objects in memory. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights. (CVE-2018-0851)

  - An information disclosure vulnerability exists when     Microsoft Office software reads out of bound memory due     to an uninitialized variable, which could disclose the     contents of memory. An attacker who successfully     exploited the vulnerability could view out of bound     memory. Exploitation of the vulnerability requires that     a user open a specially crafted file with an affected     version of Microsoft Office software. The security     update addresses the vulnerability by properly     initializing the affected variable. (CVE-2018-0853)

ID	Name	Product	Family	Severity
106817	Security Updates for Microsoft Word Viewer (February 2018)	Nessus	Windows : Microsoft Bulletins	high
106805	Security Updates for Microsoft Office Products (February 2018)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2018-0851

high

Tenable Plugins

high

high