The GDI component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office for Mac 2011, and Office 2016 for Mac allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "GDI Information Disclosure Vulnerability."

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     Graphics Device Interface (GDI) component due to     improper handling of objects in memory. A local attacker     can exploit this, via a specially crafted application,     to circumvent the Address Space Layout Randomization     (ASLR) feature and disclose sensitive memory     information. (CVE-2016-7257)

  - Multiple remote code execution vulnerabilities exist in     Microsoft Office software due to a failure to properly     handle objects in memory. An unauthenticated, remote     attacker can exploit these vulnerabilities by convincing     a user to open a specially crafted Office file,     resulting in the execution of arbitrary code in the     context of the current user. (CVE-2016-7263,     CVE-2016-7298)

  - Multiple information disclosure vulnerabilities exist in     Microsoft Office software due to an out-of-bounds memory     read error. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted Office file, resulting in the     disclosure of memory contents. (CVE-2016-7264,     CVE-2016-7268, CVE-2016-7276, CVE-2016-7290,     CVE-2016-7291)

  - An arbitrary command execution vulnerability exists in     Microsoft Office due to improper validation of registry     settings when running embedded content. An     unauthenticated, remote attacker can exploit this by     convincing a user to open a specially crafted document     file multiple times, resulting in a bypass of security     restrictions and the execution of arbitrary commands.
    (CVE-2016-7266)

  - An elevation of privilege vulnerability exists in the     Microsoft AutoUpdate (MAU) application due to improper     validation of updates. A local attacker can exploit this     by placing a specially crafted application in a location     used by the update application, resulting in the ability     to execute arbitrary code in a privileged context.
    (CVE-2016-7300)

The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in the     Windows GDI component due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit this, by convincing a user to visit a     specially crafted website or open a specially crafted     document file, to disclose the contents of memory.
    (CVE-2016-7257)

  - Multiple remote code execution vulnerabilities exist in     the Windows Graphics Component due to improper handling     of objects in memory. An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a specially crafted website or open a specially crafted     document file, to execute arbitrary code in the context     of the current user. (CVE-2016-7272, CVE-2016-7273)

ID	Name	Product	Family	Severity
95810	MS16-148: Security Update for Microsoft Office (3204068) (macOS)	Nessus	MacOS X Local Security Checks	high
95765	MS16-146: Security Update for Microsoft Graphics Component (3204066)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2016-7257

medium

Tenable Plugins

high

high