CVE-2018-8281 - Vulnerability Details - OpenCVE

A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office Remote Code Execution Vulnerability." This affects Microsoft Excel Viewer, Microsoft PowerPoint Viewer, Microsoft Office, Microsoft Office Word Viewer.

No CVSS v4.0

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.44121.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	Office Office Compatibility Pack Office Powerpoint Viewer Office Word Viewer

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:office:2016:::::mac_os::
	cpe:2.3:a:microsoft:office:2016::::click-to-run:::
	cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3::::::
	cpe:2.3:a:microsoft:office_powerpoint_viewer:-:::::::*
	cpe:2.3:a:microsoft:office_word_viewer:-:::::::*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://www.securityfocus.com/bid/104609
http://www.securitytracker.com/id/1041252
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8281

History

No history.

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2018-07-11T00:00:00

Updated: 2024-08-05T06:54:34.971Z

Reserved: 2018-03-14T00:00:00

Link: CVE-2018-8281

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-07-11T00:29:01.070

Modified: 2024-11-21T04:13:32.503

Link: CVE-2018-8281

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Microsoft Excel Viewer", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "Microsoft Excel Viewer"}]}, {"product": "Microsoft PowerPoint Viewer", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "Microsoft PowerPoint Viewer"}]}, {"product": "Microsoft Office", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "2016 Click-to-Run (C2R) for 32-bit editions"}, {"status": "affected", "version": "2016 Click-to-Run (C2R) for 64-bit editions"}, {"status": "affected", "version": "2016 for Mac"}, {"status": "affected", "version": "Compatibility Pack Service Pack 3"}]}, {"product": "Microsoft Office Word Viewer", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "Microsoft Office Word Viewer"}]}], "datePublic": "2018-07-10T00:00:00", "descriptions": [{"lang": "en", "value": "A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka \"Microsoft Office Remote Code Execution Vulnerability.\" This affects Microsoft Excel Viewer, Microsoft PowerPoint Viewer, Microsoft Office, Microsoft Office Word Viewer."}], "problemTypes": [{"descriptions": [{"description": "Remote Code Execution", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-07-11T09:57:01", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft"}, "references": [{"name": "1041252", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1041252"}, {"name": "104609", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/104609"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8281"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@microsoft.com", "ID": "CVE-2018-8281", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Microsoft Excel Viewer", "version": {"version_data": [{"version_value": "Microsoft Excel Viewer"}]}}, {"product_name": "Microsoft PowerPoint Viewer", "version": {"version_data": [{"version_value": "Microsoft PowerPoint Viewer"}]}}, {"product_name": "Microsoft Office", "version": {"version_data": [{"version_value": "2016 Click-to-Run (C2R) for 32-bit editions"}, {"version_value": "2016 Click-to-Run (C2R) for 64-bit editions"}, {"version_value": "2016 for Mac"}, {"version_value": "Compatibility Pack Service Pack 3"}]}}, {"product_name": "Microsoft Office Word Viewer", "version": {"version_data": [{"version_value": "Microsoft Office Word Viewer"}]}}]}, "vendor_name": "Microsoft"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka \"Microsoft Office Remote Code Execution Vulnerability.\" This affects Microsoft Excel Viewer, Microsoft PowerPoint Viewer, Microsoft Office, Microsoft Office Word Viewer."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Remote Code Execution"}]}]}, "references": {"reference_data": [{"name": "1041252", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1041252"}, {"name": "104609", "refsource": "BID", "url": "http://www.securityfocus.com/bid/104609"}, {"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8281", "refsource": "CONFIRM", "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8281"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:54:34.971Z"}, "title": "CVE Program Container", "references": [{"name": "1041252", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1041252"}, {"name": "104609", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/104609"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8281"}]}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2018-8281", "datePublished": "2018-07-11T00:00:00", "dateReserved": "2018-03-14T00:00:00", "dateUpdated": "2024-08-05T06:54:34.971Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:mac_os:*:*", "matchCriteriaId": "A1A868C4-0A58-4660-9492-1BADD99D8E59", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:click-to-run:*:*:*", "matchCriteriaId": "E74CB3D6-B0D7-4A6C-ABAA-170C7710D856", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*", "matchCriteriaId": "71AF058A-2E5D-4B11-88DB-8903C64B13C1", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_powerpoint_viewer:-:*:*:*:*:*:*:*", "matchCriteriaId": "D7CAF125-B409-4209-AAF9-7EB795F09280", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*", "matchCriteriaId": "C64B2636-8F96-48BA-921F-A8FA0E62DE63", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka \"Microsoft Office Remote Code Execution Vulnerability.\" This affects Microsoft Excel Viewer, Microsoft PowerPoint Viewer, Microsoft Office, Microsoft Office Word Viewer."}, {"lang": "es", "value": "Existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo en el software de Microsoft Office cuando no gestiona correctamente objetos en la memoria. Esto tambi\u00e9n se conoce como \"Microsoft Office Remote Code Execution Vulnerability\". Esto afecta a Microsoft Excel Viewer, Microsoft PowerPoint Viewer, Microsoft Office y Microsoft Office Word Viewer."}], "id": "CVE-2018-8281", "lastModified": "2024-11-21T04:13:32.503", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-07-11T00:29:01.070", "references": [{"source": "secure@microsoft.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/104609"}, {"source": "secure@microsoft.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1041252"}, {"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8281"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/104609"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1041252"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8281"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}