A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0850, CVE-2020-0851, CVE-2020-0852, CVE-2020-0892.

The Microsoft Office Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in     Microsoft Word software when it fails to properly handle     objects in memory. An attacker who successfully     exploited the vulnerability could use a specially     crafted file to perform actions in the security context     of the current user. For example, the file could then     take actions on behalf of the logged-on user with the     same permissions as the current user.  (CVE-2020-0850,     CVE-2020-0851, CVE-2020-0855, CVE-2020-0892)

  - A remote code execution vulnerability exists in     Microsoft Word software when it fails to properly handle     objects in memory. An attacker who successfully     exploited the vulnerability could use a specially     crafted file to perform actions in the security context     of the current user. For example, the file could then     take actions on behalf of the logged-on user with the     same permissions as the current user.  (CVE-2020-0852)

  - Remote code execution vulnerabilities exist in Microsoft     products that utilize the FBX library when processing     specially crafted 3D content. An attacker who     successfully exploited these vulnerabilities could gain     the same user rights as the local user. (CVE-2020-7080,     CVE-2020-7081, CVE-2020-7082, CVE-2020-7083,     CVE-2020-7084, CVE-2020-7085)

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by multiple remote code execution vulnerabilities in Microsoft Word software due to failure to properly handle objects in memory. An attacker could use a specially crafted file to perform actions in the security context of the current user. To exploit this issue, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.

ID	Name	Product	Family	Type	Severity
162025	Security Updates for Microsoft Office Products C2R (March 2020)	Nessus	Windows	Local	high
134416	Security Updates for Microsoft Office Products (March 2020)	Nessus	Windows : Microsoft Bulletins	Local	high
134408	Security Updates for Microsoft Office Products (March 2020) (macOS)	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2020-0855

high

Tenable Plugins

high

high

high