CVE-2015-1650 — Microsoft Office vulnerability

6 documents5 sources
Severity
9.3CRITICALNVD
EPSS
60.8%
top 1.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Microsoft OfficeMicrosoft Office WEB AppsMicrosoft Sharepoint Server+1 more
Timeline
PublishedApr 14
Latest updateMay 14

Description

Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages4 packages

▶NVDmicrosoft/word2007, 2010, 2013+2
▶NVDmicrosoft/office_web_apps2010, 2013+1
▶NVDmicrosoft/sharepoint_server2010, 2013+1

🔴Vulnerability Details

2
GHSA
GHSA-999c-xc55-3f6v: Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Office Compatib↗2022-05-14
▶
CVEList
CVE-2015-1650: Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Office Compatib↗2015-04-14
▶

💥Exploits & PoCs

1
Exploit-DB
D-Link Devices - HNAP SOAPAction-Header Command Execution (Metasploit)↗2015-06-01
▶

💬Community

1
Bugzilla
CVE-2015-5222 OpenShift3: Exec operations should be forbidden to privileged pods such as builder pods↗2015-08-19
▶
CVE-2015-1650 — Microsoft Office vulnerability | cvebase