A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0991.

The Microsoft Word Products are missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when     Microsoft Office improperly loads arbitrary type     libraries. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights. Users whose accounts are     configured to have fewer user rights on the system could     be less impacted than users who operate with     administrative user rights.  (CVE-2020-0760)

  - A remote code execution vulnerability exists in     Microsoft Word software when it fails to properly handle     objects in memory. An attacker who successfully     exploited the vulnerability could use a specially     crafted file to perform actions in the security context     of the current user. For example, the file could then     take actions on behalf of the logged-on user with the     same permissions as the current user.  (CVE-2020-0980)

The Microsoft PowerPoint Products are missing a security update. It is, therefore, affected by the following vulnerability :

  - A remote code execution vulnerability exists when     Microsoft Office improperly loads arbitrary type     libraries. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights. Users whose accounts are     configured to have fewer user rights on the system could     be less impacted than users who operate with     administrative user rights.  (CVE-2020-0760)

The Microsoft Visio Products are missing a security update. It is, therefore, affected by a remote code execution vulnerability. The vulnerability exists when Microsoft Office improperly loads arbitrary type libraries. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

The Microsoft Excel Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when     Microsoft Office improperly loads arbitrary type     libraries. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights. Users whose accounts are     configured to have fewer user rights on the system could     be less impacted than users who operate with     administrative user rights.  (CVE-2020-0760)

  - A remote code execution vulnerability exists in     Microsoft Excel software when the software fails to     properly handle objects in memory. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2020-0906)

The Microsoft Publisher Products are missing a security update. It is, therefore, affected by the following vulnerability :

  - A remote code execution vulnerability exists when     Microsoft Office improperly loads arbitrary type     libraries. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights. Users whose accounts are     configured to have fewer user rights on the system could     be less impacted than users who operate with     administrative user rights.  (CVE-2020-0760)

The Microsoft Office Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when     Microsoft Office improperly loads arbitrary type     libraries. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights. Users whose accounts are     configured to have fewer user rights on the system could     be less impacted than users who operate with     administrative user rights.  (CVE-2020-0760)

  - A remote code execution vulnerability exists in     Microsoft Word software when it fails to properly handle     objects in memory. An attacker who successfully     exploited the vulnerability could use a specially     crafted file to perform actions in the security context     of the current user. For example, the file could then     take actions on behalf of the logged-on user with the     same permissions as the current user.  (CVE-2020-0980)

  - A remote code execution vulnerability exists in     Microsoft Office software when the software fails to     properly handle objects in memory. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2020-0991)

  - A remote code execution vulnerability exists when the     Microsoft Office Access Connectivity Engine improperly     handles objects in memory. An attacker who successfully     exploited this vulnerability could execute arbitrary     code on a victim system. An attacker could exploit this     vulnerability by enticing a victim to open a specially     crafted file. The update addresses the vulnerability by     correcting the way the Microsoft Office Access     Connectivity Engine handles objects in memory.
    (CVE-2020-0961)

  - A remote code execution vulnerability exists in     Microsoft Excel software when the software fails to     properly handle objects in memory. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2020-0906, CVE-2020-0979)

The Microsoft Outlook application installed on the remote host is missing a security update. It is, therefore, affected by the following vulnerability :

  - A remote code execution vulnerability exists when     Microsoft Office improperly loads arbitrary type     libraries. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights. Users whose accounts are     configured to have fewer user rights on the system could     be less impacted than users who operate with     administrative user rights.  (CVE-2020-0760)

The Microsoft Project installation on the remote host is missing a security update. Therefore, a remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

The Microsoft Access Products are missing a security update.
It is, therefore, affected by the following vulnerability :

  - A remote code execution vulnerability exists when     Microsoft Office improperly loads arbitrary type     libraries. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights. Users whose accounts are     configured to have fewer user rights on the system could     be less impacted than users who operate with     administrative user rights.  (CVE-2020-0760)

ID	Name	Product	Family	Severity
162109	Security Updates for Microsoft Word Products C2R (April 2020)	Nessus	Windows	high
162087	Security Updates for Microsoft PowerPoint Products C2R (April 2020)	Nessus	Windows	high
162070	Security Updates for Microsoft Visio Products C2R (April 2020)	Nessus	Windows	high
162052	Security Updates for Microsoft Excel Products C2R (April 2020)	Nessus	Windows	high
162027	Security Updates for Microsoft Publisher Products C2R (April 2020)	Nessus	Windows	high
162026	Security Updates for Microsoft Office Products C2R (April 2020)	Nessus	Windows	high
135482	Security Updates for Microsoft Word Products (April 2020)	Nessus	Windows : Microsoft Bulletins	high
135480	Security Updates for Microsoft Visio Products (April 2020)	Nessus	Windows : Microsoft Bulletins	high
135479	Security Updates for Microsoft PowerPoint Products (April 2020)	Nessus	Windows : Microsoft Bulletins	high
135478	Security Updates for Outlook (April 2020)	Nessus	Windows : Microsoft Bulletins	high
135477	Microsoft Project RCE Vulnerability (April 2020)	Nessus	Windows : Microsoft Bulletins	high
135476	Security Updates for Microsoft Office Products (April 2020)	Nessus	Windows : Microsoft Bulletins	high
135474	Security Updates for Microsoft Excel Products (April 2020)	Nessus	Windows : Microsoft Bulletins	high
135473	Security Updates for Microsoft Access Products (April 2020)	Nessus	Windows : Microsoft Bulletins	high
135462	Security Updates for Microsoft Publisher Products (April 2020)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2020-0760

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high