CVE-2015-6124

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."

CVSS v2.0 9.3 HIGH

9.3^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 8.6 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.securitytracker.com/id/1034324
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-131

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:office:2010:sp2:x64:::::*
	cpe:2.3:a:microsoft:office:2010:sp2:x86:::::*
	cpe:2.3:a:microsoft:office:2013:sp1::::::
	cpe:2.3:a:microsoft:office_compatibility_pack::sp3::::::*
	cpe:2.3:a:microsoft:word:2007:sp3::::::

History

No history.

Information

Published : 2015-12-09 11:59

Updated : 2018-10-30 16:27

NVD link : CVE-2015-6124

Mitre link : CVE-2015-6124

CVE.ORG link : CVE-2015-6124

JSON object : View

Products Affected

microsoft

word
office
office_compatibility_pack

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"id": "CVE-2015-6124", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2015-12-09T11:59:09.347", "references": [{"url": "http://www.securitytracker.com/id/1034324", "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-131", "source": "secure@microsoft.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted Office document, aka \"Microsoft Office Memory Corruption Vulnerability.\""}, {"lang": "es", "value": "Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1 y Office Compatibility Pack SP3 permiten a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s de un documento Office manipulado, tambi\u00e9n conocida como 'Microsoft Office Memory Corruption Vulnerability'."}], "lastModified": "2018-10-30T16:27:52.233", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office:2010:sp2:x64:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69998A67-CB15-4217-8AD6-43F9BA3C6454"}, {"criteria": "cpe:2.3:a:microsoft:office:2010:sp2:x86:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "349E9084-8116-43E9-8B19-CA521C96660D"}, {"criteria": "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "120690A6-E0A1-4E36-A35A-C87109ECC064"}, {"criteria": "cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "44BC7B7B-7191-431C-8CAE-83B3F0EFF03E"}, {"criteria": "cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D006508-BFB0-4F21-A361-3DA644F51D8A"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}