Microsoft Word 2007 Service Pack 3, Microsoft Word 2010 Service Pack 2, Microsoft Office 2010 Service Pack 2, and Microsoft Office Compatibility Pack Service Pack 3 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Word Memory Corruption Vulnerability".

The Microsoft Office Products are missing a security update.
It is, therefore, affected by the following vulnerability :

  - A remote code execution vulnerability exists in     Microsoft Office software when the software fails to     properly handle objects in memory. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2017-11854)

The Microsoft Office Compatibility SP3 are missing security updates.
It is, therefore, affected by multiple vulnerabilities :

    - A remote code execution vulnerability exists in     Microsoft Office software when the software fails to     properly handle objects in memory. An attacker who     successfully exploited the vulnerability could run     arbitrary code in the context of the current user. If     the current user is logged on with administrative user     rights, an attacker could take control of the affected     system. An attacker could then install programs; view,     change, or delete data; or create new accounts with full     user rights.  (CVE-2017-11854, CVE-2017-11878)

    - A security feature bypass vulnerability exists in     Microsoft Office software by not enforcing macro     settings on an Excel document. The security feature     bypass by itself does not allow arbitrary code     execution. To successfully exploit the vulnerability, an     attacker would have to embed a control in an Excel     worksheet that specifies a macro should be run.
    (CVE-2017-11877)

The Microsoft Office Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities :

  - Microsoft has released an update for Microsoft Office that     provides enhanced security as a defense-in-depth measure.

  - A remote code execution vulnerability exists in Microsoft Office     software when the software fails to properly handle objects in     memory. An attacker who successfully exploited the vulnerability     could run arbitrary code in the context of the current user. If     the current user is logged on with administrative user rights, an     attacker could take control of the affected system. An attacker     could then install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose accounts     are configured to have fewer user rights on the system could be     less impacted than users who operate with administrative user     rights. (CVE-2017-11854)

  - A remote code execution vulnerability exists in Microsoft Office     software when the software fails to properly handle objects in     memory. An attacker who successfully exploited the vulnerability     could run arbitrary code in the context of the current user. If     the current user is logged on with administrative user rights, an     attacker could take control of the affected system. An attacker     could then install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose accounts     are configured to have fewer user rights on the system could be     less impacted than users who operate with administrative user     rights. (CVE-2017-11882)

ID	Name	Product	Family	Severity
104562	Security Updates for Microsoft Word Products (November 2017)	Nessus	Windows : Microsoft Bulletins	high
104558	Security Updates for Microsoft Office Compatibility SP3 (November 2017)	Nessus	Windows : Microsoft Bulletins	high
104557	Security Updates for Microsoft Office Products (November 2017)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2017-11854

high

Tenable Plugins

high

high

high