An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosure Vulnerability'.

The Microsoft Excel Products are missing security updates. They are, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when Microsoft     Excel improperly discloses the contents of its memory. An     attacker who exploited the vulnerability could use the     information to compromise the user's computer or data. To exploit     the vulnerability, an attacker could craft a special document     file and then convince the user to open it. An attacker must know     the memory address location where the object was created.
    (CVE-2019-0669)

The Microsoft Office Products are missing security updates. They are, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability exists when the Windows Jet     Database Engine improperly handles objects in memory. An attacker     who successfully exploited this vulnerability could execute     arbitrary code on a victim system. An attacker could exploit this     vulnerability by enticing a victim to open a specially crafted     file. (CVE-2019-0538, CVE-2019-0582)

  - A security feature bypass vulnerability exists when Microsoft     Office does not validate URLs. An attacker could send a victim a     specially crafted file, which could trick the victim into     entering credentials. An attacker who successfully exploited this     vulnerability could perform a phishing attack. (CVE-2019-0540)

  - An information disclosure vulnerability exists when Microsoft     Excel improperly discloses the contents of its memory. An     attacker who exploited the vulnerability could use the     information to compromise the user's computer or data. To exploit     the vulnerability, an attacker could craft a special document     file and then convince the user to open it. An attacker must know     the memory address location where the object was created.
    (CVE-2019-0669)

  - A remote code execution vulnerability exists when the Microsoft     Office Access Connectivity Engine improperly handles objects in     memory. An attacker who successfully exploited this vulnerability     could execute arbitrary code on a victim system. An attacker     could exploit this vulnerability by enticing a victim to open a     specially crafted file. (CVE-2019-0671,  CVE-2019-0672,     CVE-2019-0673,  CVE-2019-0674, CVE-2019-0675)

The Microsoft Office Viewers and Compatibility Products are missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A security feature bypass vulnerability exists when     Microsoft Office does not validate URLs. An attacker     could send a victim a specially crafted file, which     could trick the victim into entering credentials. An     attacker who successfully exploited this vulnerability     could perform a phishing attack. The update addresses     the vulnerability by ensuring Microsoft Office properly     validates URLs. (CVE-2019-0540)

  - An information disclosure vulnerability exists when     Microsoft Excel improperly discloses the contents of its     memory. An attacker who exploited the vulnerability     could use the information to compromise the users     computer or data. (CVE-2019-0669)

The Microsoft Office application installed on the remote macOS or Mac OS X host is missing a security update. It is, therefore, affected by a vulnerability that allows remote attackers to bypass authentication to execute an arbitrary command through the protocol- compliant traffic.

ID	Name	Product	Family	Severity
162062	Security Updates for Microsoft Excel Products C2R (February 2019)	Nessus	Windows	medium
162029	Security Updates for Microsoft Office Products C2R (February 2019)	Nessus	Windows	high
122317	Security Updates for Microsoft Office Viewers And Compatibility Products (February 2019)	Nessus	Windows : Microsoft Bulletins	medium
122247	Security Update for Microsoft Office (Feb 2019) (macOS)	Nessus	MacOS X Local Security Checks	medium
122132	Security Updates for Microsoft Office Products (February 2019)	Nessus	Windows : Microsoft Bulletins	high
122128	Security Updates for Microsoft Excel Products (February 2019)	Nessus	Windows : Microsoft Bulletins	medium

Detections

Analytics

CVE-2019-0669

medium

Tenable Plugins

medium

high

medium

medium

high

medium