CVE-2018-0852 - Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1 and RT SP1, Micro

CVE-2018-0852

Summary

Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1 and RT SP1, Microsoft Outlook 2016, and Microsoft Office 2016 Click-to-Run (C2R) allow a remote code execution vulnerability, due to how Outlook handles objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE is unique from CVE-2018-0851.

References

Vulnerable Configurations

cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:office:2016:*:*:*:click-to-run:*:*:*
cpe:2.3:a:microsoft:office:2016:*:*:*:click-to-run:*:*:*
cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:*:*:*
cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:rt:*:*
cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:rt:*:*
cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*

CVSS

Base:	9.3 (as of 24-08-2020 - 17:37)
Impact:
Exploitability:

CWE

CWE-787

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:M/Au:N/C:C/I:C/A:C

refmap via4

bid	102871
confirm	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0852
sectrack	1040368

Last major update

24-08-2020 - 17:37

Published

15-02-2018 - 02:29

Last modified

24-08-2020 - 17:37