CVE-2016-7233

Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Excel for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2013 SP1, and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted Office document, aka "Microsoft Office Information Disclosure Vulnerability."

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/94031
http://www.securitytracker.com/id/1037246
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-133
https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1232

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:excel_for_mac:2011:::::::*
	cpe:2.3:a:microsoft:office:2010:sp2::::::
	cpe:2.3:a:microsoft:office_compatibility_pack::sp3::::::*
	cpe:2.3:a:microsoft:office_web_apps:2010:sp2::::::
	cpe:2.3:a:microsoft:sharepoint_server:2013:sp1::::::
	cpe:2.3:a:microsoft:word:2007:::::::*
	cpe:2.3:a:microsoft:word:2010:sp2::::::
	cpe:2.3:a:microsoft:word_automation_services:-:::::::*
	cpe:2.3:a:microsoft:word_for_mac:2011:::::::*
	cpe:2.3:a:microsoft:word_viewer:-:::::::*

History

No history.

Information

Published : 2016-11-10 06:59

Updated : 2024-02-28 15:44

NVD link : CVE-2016-7233

Mitre link : CVE-2016-7233

CVE.ORG link : CVE-2016-7233

JSON object : View

Products Affected

microsoft

word_viewer
office_compatibility_pack
word_automation_services
office_web_apps
office
excel_for_mac
word
word_for_mac
sharepoint_server

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2016-7233", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2016-11-10T06:59:46.300", "references": [{"url": "http://www.securityfocus.com/bid/94031", "source": "secure@microsoft.com"}, {"url": "http://www.securitytracker.com/id/1037246", "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-133", "source": "secure@microsoft.com"}, {"url": "https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1232", "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Excel for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2013 SP1, and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted Office document, aka \"Microsoft Office Information Disclosure Vulnerability.\""}, {"lang": "es", "value": "Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Word para Mac 2011, Excel para Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word Automation Services en SharePoint Server 2013 SP1 y Office Web Apps 2010 SP2 permiten a atacantes remotos obtener informaci\u00f3n sensible memoria de proceso o provocar una denegaci\u00f3n de servicio cause a denial of service (escritura fuera de l\u00edmites) a trav\u00e9s de un documento Office manipulado, vulnerabilidad tambi\u00e9n conocida como \"Microsoft Office Information Disclosure Vulnerability\"."}], "lastModified": "2018-10-12T22:14:19.377", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:excel_for_mac:2011:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FF929F6-6551-4358-AFBE-3495E8DC7BFA"}, {"criteria": "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "081DE1E3-4622-4C32-8B9C-9AEC1CD20638"}, {"criteria": "cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44BC7B7B-7191-431C-8CAE-83B3F0EFF03E"}, {"criteria": "cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8235774-4B57-4793-BE26-2CDE67532EDD"}, {"criteria": "cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16F33176-442C-4EFF-8EA0-C640D203B939"}, {"criteria": "cpe:2.3:a:microsoft:word:2007:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A9B12493-4287-4AAD-9A18-D3FC3FCBE172"}, {"criteria": "cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "24EEDAD9-9656-4B21-82E4-D60B83777492"}, {"criteria": "cpe:2.3:a:microsoft:word_automation_services:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC865581-3650-4DC4-9138-C2F71AA3B850"}, {"criteria": "cpe:2.3:a:microsoft:word_for_mac:2011:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B429C3AB-B405-4156-B63E-BA2BC6A84894"}, {"criteria": "cpe:2.3:a:microsoft:word_viewer:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AC45CB0-6C84-46D3-B16D-170D46822E54"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}