The Microsoft Office application installed on the remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - Multiple remote code execution vulnerabilities exist in     Microsoft Office due to improper validation of input     before loading dynamic link library (DLL) files. An     unauthenticated, remote attacker can exploit these, by     convincing a user to open a specially crafted Office     document, to execute arbitrary code in the context of     the current user. (CVE-2017-0260. CVE-2017-8506)

  - Multiple information disclosure vulnerabilities exist in     Windows Uniscribe due to improper handling of objects in     memory. An unauthenticated, remote attacker can exploit     these, by convincing a user to visit a specially crafted     website or to open a specially crafted document file, to     disclose the contents of memory. (CVE-2017-0282,     CVE-2017-0284, CVE-2017-0285, CVE-2017-8534)

  - Multiple remote code execution vulnerabilities exist in     Windows Uniscribe due to improper handling of objects in     memory. An unauthenticated, remote attacker can exploit     these, by convincing a user to visit a specially crafted     website or open a specially crafted document, to execute     arbitrary code in the context of the current user.
    (CVE-2017-0283, CVE-2017-8528)

  - Multiple information disclosure vulnerabilities exist in     the Windows GDI component due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit these, by convincing a user to visit a     specially crafted website or to open a specially crafted     document file, to disclose the contents of memory.
    (CVE-2017-0286, CVE-2017-0287, CVE-2017-0288,     CVE-2017-0289, CVE-2017-8531, CVE-2017-8532,     CVE-2017-8533)

  - A remote code execution vulnerability exists in     Microsoft Windows due to improper parsing of PDF files.
    An unauthenticated, remote attacker can exploit this, by     convincing a user to open a specially crafted PDF file,     to execute arbitrary code in the context of the current     user. (CVE-2017-0292)

  - A remote code execution vulnerability exists in     Microsoft Outlook due to improper parsing of email     messages. An unauthenticated, remote attacker can     exploit this, by convincing a user to open a specially     crafted email message, to execute arbitrary code in the     context of the current user. (CVE-2017-8507)

  - A security bypass vulnerability exists in Microsoft     Outlook due to improper parsing of file formats. An     unauthenticated, remote attacker can exploit this, by     convincing a user to open a specially crafted Office     document, to bypass security feature protections.
    (CVE-2017-8508)

  - Multiple remote code execution vulnerabilities exist in     Microsoft Office due to improper handling of objects in     memory. An unauthenticated, remote attacker can exploit     these, by convincing a user to open a specially crafted     Office document, to execute arbitrary code in the     context of the current user. (CVE-2017-8509,     CVE-2017-8510, CVE-2017-8511, CVE-2017-8512,     CVE-2017-8550)

  - A remote code execution vulnerability exists in     Microsoft PowerPoint due to improper handling of objects     in memory. An unauthenticated, remote attacker can     exploit this, by convincing a user to open a specially     crafted file, to execute arbitrary code in the context     of the current user. (CVE-2017-8513)

  - A remote code execution vulnerability exists in the     Windows font library due to improper handling of     embedded fonts. An unauthenticated, remote attacker can     exploit this, by convincing a user to visit a specially     crafted website or open a specially crafted Microsoft     document, to execute arbitrary code in the context of     the current user. (CVE-2017-8527)

Detections

Analytics

Security Update for Microsoft Office Products (June 2017)

high Nessus Plugin ID 100782

Version 1.16

Version 1.15

Version 1.14

Version 1.16 Aug 24, 2026, 3:52 PM Logic Changes (updated to operate with detection via "Microsoft Office Detection") Plugin Feed: 202608241552
Version 1.15 Dec 16, 2025, 2:29 PM CVSSv2 score source (set to "CVE-2017-8528") Plugin Feed: 202512161429
Version 1.14 Feb 17, 2023, 10:07 PM IAVM reference Plugin Feed: 202302172207