Vulnerability Name: CVE-2016-0052 (CCN-110154) Assigned: 2015-12-04 Published: 2016-02-09 Updated: 2018-10-12 Summary: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps Server 2013 SP1, and SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0022 . CVSS v3 Severity: 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H )6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C )Exploitability Metrics: Attack Vector (AV): LocalAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): RequiredScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )7.3 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C )Exploitability Metrics: Attack Vector (AV): LocalAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
CVSS v2 Severity: 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C )Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): MediumAuthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C )Exploitability Metrics: Access Vector (AV): LocalAccess Complexity (AC): LowAthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
Vulnerability Type: CWE-119 Vulnerability Consequences: Gain Access References: Source: MITRE Type: CNACVE-2016-0052 Source: CCN Type: Microsoft Security Bulletin MS16-015Security Update for Microsoft Office to Address Remote Code Execution (3134226) Source: CCN Type: Microsoft Security Bulletin MS16-029Security Update for Microsoft Office to Address Remote Code Execution (3141806) Source: CCN Type: Microsoft Security Bulletin MS16-042Security Update for Microsoft Office (3148775) Source: CCN Type: Microsoft Security Bulletin MS16-054Security Update for Microsoft Office (3155544) Source: CCN Type: Microsoft Security Bulletin MS16-070Security Update for Office (3163610) Source: CCN Type: Microsoft Security Bulletin MS16-088Security Updates for Office (3170008) Source: CCN Type: Microsoft Security Bulletin MS16-099Security Update for Office (3177451) Source: CCN Type: Microsoft Security Bulletin MS16-107Security Update for Microsoft Office (3185852) Source: CCN Type: Microsoft Security Bulletin MS16-121Security Update for Microsoft Office (3194063) Source: CCN Type: Microsoft Security Bulletin MS16-133Security Update for Microsoft Office (3199168) Source: CCN Type: Microsoft Security Bulletin MS16-148Security Update for Microsoft Office (3204068) Source: CCN Type: Microsoft Security Bulletin MS17-002Security Update for Microsoft Office (3214291) Source: CCN Type: Microsoft Security Bulletin MS17-013Security Update for Microsoft Graphics Component (4013075) Source: CCN Type: Microsoft Security Bulletin MS17-014Security Update for Microsoft Office (4013241) Source: SECTRACK Type: UNKNOWN1034975 Source: SECTRACK Type: UNKNOWN1034976 Source: MS Type: UNKNOWNMS16-015 Source: XF Type: UNKNOWNms-office-cve20160052-code-exec(110154) Vulnerable Configuration: Configuration 1 :cpe:/a:microsoft:office:2010:sp2:x64:*:*:*:*:* OR cpe:/a:microsoft:office:2010:sp2:x86:*:*:*:*:* OR cpe:/a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:office_web_apps_server:2013:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:sharepoint_server:2013:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:word:2007:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:word:2010:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:word:2013:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:word:2013:sp1:*:*:rt:*:*:* OR cpe:/a:microsoft:word:2016:*:*:*:*:*:*:* OR cpe:/a:microsoft:word_for_mac:2011:*:*:*:*:*:*:* OR cpe:/a:microsoft:word_for_mac:2016:*:*:*:*:*:*:* OR cpe:/a:microsoft:word_viewer:*:*:*:*:*:*:*:* Configuration CCN 1 :cpe:/a:microsoft:excel_viewer:*:*:*:*:*:*:*:* OR cpe:/a:microsoft:word_viewer:*:*:*:*:*:*:*:* OR cpe:/a:microsoft:office:2011:*:*:*:*:mac:*:* OR cpe:/a:microsoft:office:2007:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:excel:2007:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:word:2007:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:office:2010:sp2:*:*:*:*:x64:* OR cpe:/a:microsoft:office:2010:sp2:x32:*:*:*:*:* OR cpe:/a:microsoft:excel:2010:sp2:*:*:*:*:x64:* OR cpe:/a:microsoft:excel:2010:sp2:*:*:*:*:x32:* OR cpe:/a:microsoft:word:2010:sp2:*:*:*:*:x32:* OR cpe:/a:microsoft:word:2010:sp2:*:*:*:*:x64:* OR cpe:/a:microsoft:office_web_apps:2013:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:office:2013:sp1:x32:*:*:*:*:* OR cpe:/a:microsoft:office:2013:sp1:*:*:*:*:x64:* OR cpe:/a:microsoft:sharepoint_server:2013:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:excel:2013:sp1:*:*:*:*:x32:* OR cpe:/a:microsoft:excel:2013:sp1:*:*:*:*:x64:* OR cpe:/a:microsoft:excel:2013:sp1:*:*:rt:*:*:* OR cpe:/a:microsoft:word:2013:sp1:*:*:*:*:x32:* OR cpe:/a:microsoft:word:2013:sp1:*:*:*:*:x64:* OR cpe:/a:microsoft:word:2013:sp1:*:*:rt:*:*:* OR cpe:/a:microsoft:excel_web_app:2010:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:excel_web_app_2013:-:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:word:2011:*:*:*:mac:*:*:* OR cpe:/a:microsoft:excel:2011:*:*:*:*:mac:*:* OR cpe:/a:microsoft:excel:2016:*:*:*:*:mac:*:* OR cpe:/a:microsoft:excel:2016:*:*:*:*:*:x32:* OR cpe:/a:microsoft:excel:2016:*:*:*:*:*:x64:* OR cpe:/a:microsoft:word:2016:*:*:*:*:*:x32:* OR cpe:/a:microsoft:word:2016:*:*:*:*:*:x64:* OR cpe:/a:microsoft:office:2016:*:x32:*:*:*:*:* OR cpe:/a:microsoft:office:2016:*:*:*:*:*:x64:* OR cpe:/a:microsoft:office:2016:*:*:*:*:mac:*:* OR cpe:/a:microsoft:outlook:2016:*:*:*:*:*:x32:* AND cpe:/a:microsoft:sharepoint_server:2007:sp3:x64:*:*:*:*:* OR cpe:/a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:* Denotes that component is vulnerable BACK
microsoft office 2010 sp2
microsoft office 2010 sp2
microsoft office compatibility pack * sp3
microsoft office web apps server 2013 sp1
microsoft sharepoint server 2013 sp1
microsoft word 2007 sp3
microsoft word 2010 sp2
microsoft word 2013 sp1
microsoft word 2013 sp1
microsoft word 2016
microsoft word for mac 2011
microsoft word for mac 2016
microsoft word viewer *
microsoft excel viewer *
microsoft word viewer *
microsoft office 2011
microsoft office 2007 sp3
microsoft excel 2007 sp3
microsoft office compatibility pack * sp3
microsoft word 2007 sp3
microsoft office 2010 sp2
microsoft office 2010 sp2
microsoft excel 2010 sp2
microsoft excel 2010 sp2
microsoft word 2010 sp2
microsoft word 2010 sp2
microsoft office web apps 2013 sp1
microsoft office 2013 sp1
microsoft office 2013 sp1
microsoft sharepoint server 2013 sp1
microsoft sharepoint foundation 2013 sp1
microsoft excel 2013 sp1
microsoft excel 2013 sp1
microsoft excel 2013 sp1
microsoft word 2013 sp1
microsoft word 2013 sp1
microsoft word 2013 sp1
microsoft excel web app 2010 sp2
microsoft excel web app 2013 - sp1
microsoft word 2011
microsoft excel 2011
microsoft excel 2016
microsoft excel 2016
microsoft excel 2016
microsoft word 2016
microsoft word 2016
microsoft office 2016
microsoft office 2016
microsoft office 2016
microsoft outlook 2016
microsoft sharepoint server 2007 sp3
microsoft sharepoint server 2010 sp2