A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'.

The Microsoft Office Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-1246)

  - A remote code execution vulnerability exists in     Microsoft Excel software when the software fails to     properly handle objects in memory. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2019-1297)

  - An information disclosure vulnerability exists when     Microsoft Excel improperly discloses the contents of its     memory. An attacker who exploited the vulnerability     could use the information to compromise the users     computer or data.  (CVE-2019-1263)

  - A security feature bypass vulnerability exists when     Microsoft Office improperly handles input. An attacker     who successfully exploited the vulnerability could     execute arbitrary commands. In a file-sharing attack     scenario, an attacker could provide a specially crafted     document file designed to exploit the vulnerability, and     then convince a user to open the document file and     interact with the document by clicking a specific cell.
    The update addresses the vulnerability by correcting how     Microsoft Office handles input. (CVE-2019-1264)

The Microsoft Excel Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in     Microsoft Excel software when the software fails to     properly handle objects in memory. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2019-1297)

  - An information disclosure vulnerability exists when     Microsoft Excel improperly discloses the contents of its     memory. An attacker who exploited the vulnerability     could use the information to compromise the users     computer or data.  (CVE-2019-1263)

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability exists in Microsoft Excel due to improper disclosure of contents in memory.
    An unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to     obtain information for further compromise the system. (CVE-2019-1263)

  - A remote code execution vulnerability exists in Microsoft Excel due to improper handling of objects in memory. An     unauthenticated, remote attacker can exploit this, by convincing a user to open a specially crafted file, to execute     arbitrary commands. (CVE-2019-1297)

ID	Name	Product	Family	Type	Severity
162077	Security Updates for Microsoft Office Products C2R (September 2019)	Nessus	Windows	Local	high
162049	Security Updates for Microsoft Excel Products C2R (September 2019)	Nessus	Windows	Local	high
128706	Security Update for Microsoft Office (September 2019) (macOS)	Nessus	MacOS X Local Security Checks	Local	high
128648	Security Updates for Microsoft Office Products (September 2019)	Nessus	Windows : Microsoft Bulletins	Local	high
128645	Security Updates for Microsoft Excel Products (September 2019)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2019-1297

high

Tenable Plugins

high

high

high

high

high