CVE-2016-0141
published 2016-09-14CVE-2016-0141: The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation…
PriorityP431medium6.5CVSS 3.0
AVNACLPRNUIRSUCHINAN
EPSS
4.90%
91.1th percentile
The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure Vulnerability."
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| msrc | microsoft_office_2007_service_pack_3 | — | — |
| msrc | microsoft_office_2010_service_pack_2 | — | — |
| msrc | microsoft_office_2013_service_pack_1 | — | — |
| msrc | microsoft_office_2016 | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_msrc6.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v6rf-3vh3-4jf3: The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save opera
ghsa_unreviewed·2022-05-14
CVE-2016-0141 [MEDIUM] CWE-200 GHSA-v6rf-3vh3-4jf3: The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save opera
The Visual Basic macros in Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2016 export a certificate-store private key during a document-save operation, which allows attackers to obtain sensitive information via unspecified vectors, aka "Microsoft Information Disclosure Vulnerability."
Microsoft
Microsoft Office Information Disclosure Vulnerability
vendor_msrc·2016-09-13·CVSS 6.5
CVE-2016-0141 [MEDIUM] Microsoft Office Information Disclosure Vulnerability
Microsoft Office Information Disclosure Vulnerability
Description: An information disclosure vulnerability exists when Microsoft Outlook fails to enforce copy/paste permissions on DRM-protected emails. An attacker who successfully exploited the vulnerability could potentially extract plaintext content from DRM-protected draft emails.
The attacker would have to use another vulnerability to gain access to the victim's Drafts folder, either locally on the victim's system or remotely via MAPI.
The security update addresses the vulnerability by correcting how Microsoft Outlook enforces DRM copy/paste permissions.
FAQ: I am being offered this update for software that is not specifically indicated as being affected in the Affected Software and Vulnerability Severity Ratings table. Why am I bein
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/92903http://www.securitytracker.com/id/1036785https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-107http://www.securityfocus.com/bid/92903http://www.securitytracker.com/id/1036785https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-107
2016-09-14
Published