An information disclosure vulnerability exists when Microsoft Outlook improperly handles certain types of messages, aka "Microsoft Outlook Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Outlook.

The Microsoft Office Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability exists in the way     that the MSHTML engine improperly validates input. An     attacker could execute arbitrary code in the context of     the current user. (CVE-2019-0541)

  - An information disclosure vulnerability exists when     Microsoft Outlook improperly handles certain types of     messages. An attacker who successfully exploited this     vulnerability could gather information about the victim.
    An attacker could exploit this vulnerability by sending     a specially crafted email to the victim. The update     addresses the vulnerability by correcting the way     Microsoft Outlook handles these types of messages.
    (CVE-2019-0559)

  - An information disclosure vulnerability exists when     Microsoft Office improperly discloses the contents of     its memory. An attacker who exploited the vulnerability     could use the information to compromise the users     computer or data. (CVE-2019-0560)

  - An information disclosure vulnerability exists when     Microsoft Office improperly discloses the contents of     its memory. An attacker who exploited the vulnerability     could use the information to compromise the users     computer or data. (CVE-2019-0560)

  - A remote code execution vulnerability exists in     Microsoft Word software when it fails to properly handle     objects in memory. An attacker who successfully     exploited the vulnerability could use a specially     crafted file to perform actions in the security context     of the current user. For example, the file could then     take actions on behalf of the logged-on user with the     same permissions as the current user. (CVE-2019-0585)

The Microsoft Outlook application installed on the remote host is missing a security update. It is, therefore, affected by the following vulnerability :

  - An information disclosure vulnerability exists when     Microsoft Outlook improperly handles certain types of     messages. An attacker who successfully exploited this     vulnerability could gather information about the victim.
    An attacker could exploit this vulnerability by sending     a specially crafted email to the victim. The update     addresses the vulnerability by correcting the way     Microsoft Outlook handles these types of messages.
    (CVE-2019-0559)

ID	Name	Product	Family	Severity
162100	Security Updates for Microsoft Office Products C2R (January 2019)	Nessus	Windows	high
121027	Security Updates for Outlook (January 2019)	Nessus	Windows : Microsoft Bulletins	medium
121024	Security Updates for Microsoft Office Products (January 2019)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2019-0559

medium

Tenable Plugins

high

medium

high