ID CVE-2018-0851
Summary Microsoft Office 2007 SP2, Microsoft Office Word Viewer, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1 and RT SP1, Microsoft Office 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Office handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0852.
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:office:2007:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:office:2007:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:office:2016:*:*:*:click-to-run:*:*:*
    cpe:2.3:a:microsoft:office:2016:*:*:*:click-to-run:*:*:*
  • cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:*
    cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:*:*:*
    cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:rt:*:*
    cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:rt:*:*
  • cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*
CVSS
Base: 9.3 (as of 24-08-2020 - 17:37)
Impact:
Exploitability:
CWE CWE-787
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:C/I:C/A:C
refmap via4
bid 102870
confirm https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0851
sectrack 1040381
Last major update 24-08-2020 - 17:37
Published 15-02-2018 - 02:29
Last modified 24-08-2020 - 17:37
Back to Top