cnvd - cnvd-2018-12565

cnvd-2018-12565

Vulnerability from cnvd

Title: Microsoft Excel信息泄露漏洞（CNVD-2018-12565）

Description:

Microsoft Excel 2010 SP2等都是美国微软（Microsoft）公司的产品。Microsoft Office 2010 SP2是一款办公软件套件产品。Excel 2010 SP2是Office套件中的一套电子表格处理软件。

Microsoft Excel中存在信息泄露漏洞，该漏洞源于程序未能正确地披露内存内容。远程攻击者可通过诱使用户打开特制的文档文件利用该漏洞获取敏感信息。

Severity: 中

Patch Name: Microsoft Excel信息泄露漏洞（CNVD-2018-12565）的补丁

Patch Description:

Microsoft Excel中存在信息泄露漏洞，该漏洞源于程序未能正确地披露内存内容。远程攻击者可通过诱使用户打开特制的文档文件利用该漏洞获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布漏洞修复程序，请及时关注更新： https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8246

Reference: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8246

Impacted products

Name
['Microsoft Office Compatibility Pack SP3', 'Microsoft Office 2010 SP2', 'Microsoft Excel 2013 SP1', 'Microsoft Excel 2013 RT SP1', 'Microsoft Excel Viewer', 'Microsoft Excel 2016', 'Microsoft Office 2016 Click-to-Run (C2R)']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "104322"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-8246"
    }
  },
  "description": "Microsoft Excel 2010 SP2\u7b49\u90fd\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Microsoft Office 2010 SP2\u662f\u4e00\u6b3e\u529e\u516c\u8f6f\u4ef6\u5957\u4ef6\u4ea7\u54c1\u3002Excel 2010 SP2\u662fOffice\u5957\u4ef6\u4e2d\u7684\u4e00\u5957\u7535\u5b50\u8868\u683c\u5904\u7406\u8f6f\u4ef6\u3002\r\n\r\nMicrosoft Excel\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u5730\u62ab\u9732\u5185\u5b58\u5185\u5bb9\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8bf1\u4f7f\u7528\u6237\u6253\u5f00\u7279\u5236\u7684\u6587\u6863\u6587\u4ef6\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "Ying Xinlei of IceSword Lab, Qihoo 360",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8246",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-12565",
  "openTime": "2018-07-05",
  "patchDescription": "Microsoft Excel 2010 SP2\u7b49\u90fd\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002Microsoft Office 2010 SP2\u662f\u4e00\u6b3e\u529e\u516c\u8f6f\u4ef6\u5957\u4ef6\u4ea7\u54c1\u3002Excel 2010 SP2\u662fOffice\u5957\u4ef6\u4e2d\u7684\u4e00\u5957\u7535\u5b50\u8868\u683c\u5904\u7406\u8f6f\u4ef6\u3002\r\n\r\nMicrosoft Excel\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u6b63\u786e\u5730\u62ab\u9732\u5185\u5b58\u5185\u5bb9\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8bf1\u4f7f\u7528\u6237\u6253\u5f00\u7279\u5236\u7684\u6587\u6863\u6587\u4ef6\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Excel\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2018-12565\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Office Compatibility Pack SP3",
      "Microsoft Office 2010 SP2",
      "Microsoft Excel 2013 SP1",
      "Microsoft Excel 2013 RT  SP1",
      "Microsoft Excel Viewer",
      "Microsoft Excel 2016",
      "Microsoft Office 2016 Click-to-Run (C2R)"
    ]
  },
  "referenceLink": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8246",
  "serverity": "\u4e2d",
  "submitTime": "2018-06-13",
  "title": "Microsoft Excel\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2018-12565\uff09"
}

CVE-2018-8246 (GCVE-0-2018-8246)

Vulnerability from cvelistv5

Published

2018-06-14 12:00

Modified

2024-08-05 06:46

Severity ?

CWE

Summary

An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosure Vulnerability." This affects Microsoft Excel Viewer, Microsoft Office, Microsoft Excel.

References

▼	URL	Tags
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8246	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1041109	vdb-entry, x_refsource_SECTRACK
	http://www.securityfocus.com/bid/104322	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:46:13.811Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8246"
          },
          {
            "name": "1041109",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041109"
          },
          {
            "name": "104322",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104322"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-06-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka \"Microsoft Excel Information Disclosure Vulnerability.\" This affects Microsoft Excel Viewer, Microsoft Office, Microsoft Excel."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-15T09:57:01",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8246"
        },
        {
          "name": "1041109",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041109"
        },
        {
          "name": "104322",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104322"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2018-8246",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka \"Microsoft Excel Information Disclosure Vulnerability.\" This affects Microsoft Excel Viewer, Microsoft Office, Microsoft Excel."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8246",
              "refsource": "CONFIRM",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8246"
            },
            {
              "name": "1041109",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041109"
            },
            {
              "name": "104322",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104322"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2018-8246",
    "datePublished": "2018-06-14T12:00:00",
    "dateReserved": "2018-03-14T00:00:00",
    "dateUpdated": "2024-08-05T06:46:13.811Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted