106102

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8598

The Microsoft Excel Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when     Microsoft Excel software reads out of bound memory due     to an uninitialized variable, which could disclose the     contents of memory. An attacker who successfully     exploited the vulnerability could view out of bound     memory. Exploitation of the vulnerability requires that     a user open a specially crafted file with an affected     version of Microsoft Excel software. The security update     addresses the vulnerability by properly initializing the     affected variable. (CVE-2018-8627)

  - A remote code execution vulnerability exists in     Microsoft Excel software when the software fails to     properly handle objects in memory. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2018-8597, CVE-2018-8636)

  - An information disclosure vulnerability exists when     Microsoft Excel improperly discloses the contents of its     memory. An attacker who exploited the vulnerability     could use the information to compromise the users     computer or data.  (CVE-2018-8598)

ID	Name	Product	Family	Severity
162063	Security Updates for Microsoft Excel Products C2R (December 2018)	Nessus	Windows	high
119592	Security Updates for Microsoft Excel Products (December 2018)	Nessus	Windows : Microsoft Bulletins	high

CVE-2018-8598

medium

Tenable Plugins

high

high