A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in Protected View, aka "Microsoft PowerPoint Remote Code Execution Vulnerability." This affects Office 365 ProPlus, PowerPoint Viewer, Microsoft Office, Microsoft PowerPoint.

The Microsoft PowerPoint Products are missing a security update. It is, therefore, affected by the following vulnerability :

  - A remote code execution vulnerability exists in     Microsoft PowerPoint software when the software fails to     properly handle objects in Protected View. An attacker     who successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2018-8501)

The Microsoft Office Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in     Microsoft Word software when the software fails to     properly handle objects in Protected View. An attacker     who successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2018-8504)

  - A remote code execution vulnerability exists in     Microsoft PowerPoint software when the software fails to     properly handle objects in Protected View. An attacker     who successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2018-8501)

  - A remote code execution vulnerability exists in     Microsoft Excel software when the software fails to     properly handle objects in Protected View. An attacker     who successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2018-8502)

The Microsoft Office Viewer Products are missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in     Microsoft PowerPoint software when the software fails to     properly handle objects in Protected View. An attacker     who successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2018-8501)

  - A remote code execution vulnerability exists in the way     that Microsoft Graphics Components handle objects in     memory. An attacker who successfully exploited the     vulnerability could execute arbitrary code on a target     system.  (CVE-2018-8432)

  - An information disclosure vulnerability exists in the     way that Microsoft Graphics Components handle objects in     memory. An attacker who successfully exploited the     vulnerability could obtain information that could be     useful for further exploitation.  (CVE-2018-8427)

ID	Name	Product	Family	Severity
162098	Security Updates for Microsoft PowerPoint Products C2R (October 2018)	Nessus	Windows	high
162056	Security Updates for Microsoft Office Products C2R (October 2018)	Nessus	Windows	high
118015	Security Updates for Microsoft PowerPoint Products (October 2018)	Nessus	Windows : Microsoft Bulletins	high
118012	Security Updates for Microsoft Office Viewer Products / Office Compatibility Products (October 2018)	Nessus	Windows : Microsoft Bulletins	high
118010	Security Updates for Microsoft Office Products (October 2018)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2018-8501

high

Tenable Plugins

high

high

high

high

high