Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

The remote Mac OS X host is running a version of Microsoft Excel that is affected by the following vulnerabilities :

  - Two memory corruption vulnerabilities exist due to the     way the application handles objects in memory when     parsing Office files. (CVE-2013-1315 / CVE-2013-3158)

  - An information disclosure vulnerability exists due to     the way the application parses XML files containing     external entities. (CVE-2013-3159)

If an attacker can trick a user on the affected host into opening a specially crafted Excel file, it may be possible to leverage these issues to read arbitrary files on the target system or execute arbitrary code, subject to the user's privileges.

The remote Windows host is running a version of Microsoft Excel that is affected by the following vulnerabilities :

  - Two memory corruption vulnerabilities exist due to the     way the application handles objects in memory when     parsing Office files. (CVE-2013-1315 / CVE-2013-3158)

  - An information disclosure vulnerability exists due to     the way the application parses XML files containing     external entities. (CVE-2013-3159)

If an attacker can trick a user on the affected host into opening a specially crafted Excel file, it may be possible to leverage these issues to read arbitrary files on the target system or execute arbitrary code, subject to the user's privileges.

The versions of Office SharePoint Server, SharePoint Server, Windows SharePoint Services, SharePoint Foundation, or Office Web Apps installed on the remote host are affected by multiple vulnerabilities :

  - A denial of service vulnerability exits that could cause     the W3WP process to stop responding. (CVE-2013-0081)

  - A remote code execution vulnerability exists in the way     Microsoft Office Services and Web Apps parse content in     specially crafted files. (CVE-2013-1315)

  - A remote code execution vulnerability exists in the way     SharePoint Server handles unassigned workflows.
    (CVE-2013-1330)

  - An unspecified cross-site scripting vulnerability     exists. (CVE-2013-3179)

  - An unspecified POST cross-site scripting vulnerability     exists. (CVE-2013-3180)

  - Multiple memory corruption vulnerabilities exist in the     way that Microsoft Office software parses specially     crafted files. (CVE-2013-2847, CVE-2013-3848,     CVE-2013-3849, CVE-2013-3857, CVE-2013-3858)

ID	Name	Product	Family	Severity
69839	MS13-073: Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2858300) (Mac OS X)	Nessus	MacOS X Local Security Checks	high
69833	MS13-073: Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2858300))	Nessus	Windows : Microsoft Bulletins	high
69827	MS13-067: Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (2834052)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2013-1315

high

Tenable Plugins

high

high

critical