| Vulnerability Name: | CVE-2017-11882 (CCN-134283) | ||||||||||||
| Assigned: | 2017-11-14 | ||||||||||||
| Published: | 2017-11-14 | ||||||||||||
| Updated: | 2021-03-16 | ||||||||||||
| Summary: | Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884. | ||||||||||||
| CVSS v3 Severity: | 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) 7.2 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
7.2 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C)
| ||||||||||||
| CVSS v2 Severity: | 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
| ||||||||||||
| Vulnerability Type: | CWE-119 | ||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2017-11882 Source: MISC Type: Exploit, Third Party Advisory http://reversingminds-blog.logdown.com/posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882 Source: CCN Type: US-CERT VU#421280 Microsoft Office Equation Editor stack buffer overflow Source: BID Type: Third Party Advisory, VDB Entry 101757 Source: CCN Type: BID-101757 Microsoft Office CVE-2017-11882 Memory Corruption Vulnerability Source: SECTRACK Type: Third Party Advisory, VDB Entry 1039783 Source: MISC Type: Exploit, Third Party Advisory https://0patch.blogspot.com/2017/11/did-microsoft-just-manually-patch-their.html Source: MISC Type: Exploit, Patch, Third Party Advisory https://0patch.blogspot.com/2017/11/official-patch-for-cve-2017-11882-meets.html Source: XF Type: UNKNOWN ms-office-cve201711882-code-exec(134283) Source: MISC Type: Exploit, Third Party Advisory https://github.com/0x09AL/CVE-2017-11882-metasploit Source: MISC Type: Exploit, Third Party Advisory https://github.com/embedi/CVE-2017-11882 Source: MISC Type: Exploit, Third Party Advisory https://github.com/rxwx/CVE-2017-11882 Source: MISC Type: Exploit, Third Party Advisory https://github.com/unamer/CVE-2017-11882 Source: CCN Type: Packet Storm Security [12-06-2017] Microsoft Office Equation Editor Code Execution Source: CCN Type: Microsoft Security TechCenter - November 2017 Microsoft Office Memory Corruption Vulnerability Source: CONFIRM Type: Patch, Vendor Advisory https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882 Source: MISC Type: Exploit, Third Party Advisory https://researchcenter.paloaltonetworks.com/2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/ Source: MISC Type: Exploit, Mitigation, Third Party Advisory https://web.archive.org/web/20181104111128/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about/ Source: CCN Type: CYBERSECURITY & INFRASTRUCTURE SECURITY AGENCY KNOWN EXPLOITED VULNERABILITIES CATALOG Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [11-20-2017] Source: EXPLOIT-DB Type: Exploit, Third Party Advisory, VDB Entry 43163 Source: CERT-VN Type: Third Party Advisory, US Government Resource VU#421280 | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||
| BACK | |||||||||||||