Vulnerability Name: CVE-2016-7193 (CCN-117292) Assigned: 2016-10-11 Published: 2016-10-11 Updated: 2018-10-12 Summary: Microsoft Word 2007 SP2, Office 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, Word Automation Services on SharePoint Server 2013 SP1, Office Web Apps 2010 SP2, Office Web Apps Server 2013 SP1, and Office Online Server allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability." CVSS v3 Severity: 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H )7.2 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C )Exploitability Metrics: Attack Vector (AV): LocalAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): RequiredScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )7.8 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C )Exploitability Metrics: Attack Vector (AV): LocalAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
CVSS v2 Severity: 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C )Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): MediumAuthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C )Exploitability Metrics: Access Vector (AV): LocalAccess Complexity (AC): LowAthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
Vulnerability Type: CWE-119 Vulnerability Consequences: Gain Access References: Source: MITRE Type: CNACVE-2016-7193 Source: CCN Type: Microsoft Security Bulletin MS16-121Security Update for Microsoft Office (3194063) Source: CCN Type: Microsoft Security Bulletin MS16-133Security Update for Microsoft Office (3199168) Source: CCN Type: Microsoft Security Bulletin MS16-148Security Update for Microsoft Office (3204068) Source: CCN Type: Microsoft Security Bulletin MS17-002Security Update for Microsoft Office (3214291) Source: CCN Type: Microsoft Security Bulletin MS17-013Security Update for Microsoft Graphics Component (4013075) Source: CCN Type: Microsoft Security Bulletin MS17-014Security Update for Microsoft Office (4013241) Source: BID Type: UNKNOWN93372 Source: SECTRACK Type: UNKNOWN1036984 Source: MS Type: UNKNOWNMS16-121 Source: XF Type: UNKNOWNms-office-cve20167193-code-exec(117292) Source: CCN Type: CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCYKNOWN EXPLOITED VULNERABILITIES CATALOG Vulnerable Configuration: Configuration 1 :cpe:/a:microsoft:office:2010:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:office_online_server:*:*:*:*:*:*:*:* OR cpe:/a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:office_web_apps_server:2013:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:office_word_viewer:-:*:*:*:*:*:*:* OR cpe:/a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:sharepoint_server:2013:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:word:2007:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:word:2013:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:word:2013:sp1:*:*:rt:*:*:* OR cpe:/a:microsoft:word:2016:*:*:*:*:*:*:* OR cpe:/a:microsoft:word_automation_services:-:*:*:*:*:sharepoint:*:* OR cpe:/a:microsoft:word_for_mac:2011:*:*:*:*:*:*:* OR cpe:/a:microsoft:word_for_mac:2016:*:*:*:*:*:*:* Configuration CCN 1 :cpe:/a:microsoft:word_viewer:-:*:*:*:*:*:*:* OR cpe:/a:microsoft:office_compatibility_pack::sp3:*:*:*:*:*:* OR cpe:/a:microsoft:word:2007:sp3:*:*:*:*:*:* OR cpe:/a:microsoft:office:2010:sp2:x64:*:*:*:*:* OR cpe:/a:microsoft:office:2010:sp2:x32:*:*:*:*:* OR cpe:/a:microsoft:word:2010:sp2:*:*:*:*:x32:* OR cpe:/a:microsoft:word:2010:sp2:*:*:*:*:x64:* OR cpe:/a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:office_web_apps:2013:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:word:2013:sp1:*:*:*:*:x32:* OR cpe:/a:microsoft:word:2013:sp1:*:*:*:*:x64:* OR cpe:/a:microsoft:word:2013:sp1:~~rt~~~:*:*:*:*:* OR cpe:/a:microsoft:word:2011::~~mac~~~:*:*:*:*:* OR cpe:/a:microsoft:word:2016:*:*:*:*:*:x32:* OR cpe:/a:microsoft:word:2016:*:*:*:*:*:x64:* OR cpe:/a:microsoft:word:2016:*:*:*:*:*:mac:* OR cpe:/a:microsoft:office_online_server:-:*:*:*:*:*:*:* AND cpe:/a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:sharepoint_server:2013:sp1:*:*:*:*:*:* Denotes that component is vulnerable Oval Definitions Definition ID Class Title Last Modified oval:org.cisecurity:def:1375 V Microsoft Office Memory Corruption Vulnerability – CVE-2016-7193 (MS16-121) 2016-12-09
BACK
microsoft office 2010 sp2
microsoft office compatibility pack - sp3
microsoft office online server *
microsoft office web apps 2010 sp2
microsoft office web apps server 2013 sp1
microsoft office word viewer -
microsoft sharepoint server 2010 sp2
microsoft sharepoint server 2013 sp1
microsoft word 2007 sp2
microsoft word 2013 sp1
microsoft word 2013 sp1
microsoft word 2016
microsoft word automation services -
microsoft word for mac 2011
microsoft word for mac 2016
microsoft word viewer -
microsoft office compatibility pack sp3
microsoft word 2007 sp3
microsoft office 2010 sp2
microsoft office 2010 sp2
microsoft word 2010 sp2
microsoft word 2010 sp2
microsoft office web apps 2010 sp2
microsoft office web apps 2013 sp1
microsoft word 2013 sp1
microsoft word 2013 sp1
microsoft word 2013 sp1
microsoft word 2011
microsoft word 2016
microsoft word 2016
microsoft word 2016
microsoft office online server -
microsoft sharepoint server 2010 sp2
microsoft sharepoint server 2013 sp1