CVE-2016-0183 — Improper Access Control in Microsoft Office

CWE-284 — Improper Access Control6 documents5 sources
Severity
8.8HIGHNVD
EPSS
40.4%
top 2.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Microsoft OfficeMicrosoft Office WEB AppsMicrosoft Sharepoint Server+1 more
Timeline
PublishedMay 11
Latest updateMay 14

Description

The Windows font library in Microsoft Office 2010 SP2, Word 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allows remote attackers to execute arbitrary code via a crafted embedded font, aka "Microsoft Office Graphics RCE Vulnerability."

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶NVDmicrosoft/word2010

🔴Vulnerability Details

2
GHSA
GHSA-79g5-g637-3gxp: The Windows font library in Microsoft Office 2010 SP2, Word 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010↗2022-05-14
▶
CVEList
CVE-2016-0183: The Windows font library in Microsoft Office 2010 SP2, Word 2010 SP2, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010↗2016-05-11
▶

📋Vendor Advisories

1
Microsoft
Microsoft Office Graphics Remote Code Execution Vulnerability↗2016-05-10
▶
CVE-2016-0183 — Improper Access Control in Microsoft | cvebase