SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Microsoft Word Vendors:   Microsoft
Microsoft Word Memory Corruption Flaws Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1030031
SecurityTracker URL:  http://securitytracker.com/id/1030031
CVE Reference:   CVE-2014-1757, CVE-2014-1758   (Links to External Site)
Date:  Apr 8 2014
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2003 SP3, 2007 SP3, 2010 SP1, 2010 SP2, 2013, 2013 RT, 2013 RT SP1; also Microsoft Office Compatibility Pack SP3 and Word Viewer; also Office for Mac 2011
Description:   Two vulnerabilities were reported in Microsoft Word. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create a specially crafted, binary-formatted Word document that, when loaded by the target user, will trigger a memory allocation error and execute arbitrary code on the target system [CVE-2014-1757]. The code will run with the privileges of the target user.

Will Dormann of the CERT/CC reported this vulnerability.

A remote user can create a specially crafted Office file that, when loaded by the target user, will trigger a stack overflow and execute arbitrary code on the target system [CVE-2014-1758]. The code will run with the privileges of the target user.

Yuhong Bao reported this vulnerability.

Impact:   A remote user can create a file that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   The vendor has issued the following fixes:

Microsoft Word 2003 Service Pack 3:

http://www.microsoft.com/downloads/details.aspx?familyid=2065136e-7dc7-4995-81cf-ff9dd472b43e

Microsoft Word 2007 Service Pack 3:

http://www.microsoft.com/downloads/details.aspx?familyid=9a36e221-159d-4baa-a619-267fe89b5209

Microsoft Word 2010 Service Pack 1 (32-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=d92b4932-8854-4073-9ae9-841c48aace68

Microsoft Word 2010 Service Pack 2 (32-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=d92b4932-8854-4073-9ae9-841c48aace68

Microsoft Word 2010 Service Pack 1 (32-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=9cbde0bf-b0cc-408e-9dda-99dfc8de2133

Microsoft Word 2010 Service Pack 2 (32-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=9cbde0bf-b0cc-408e-9dda-99dfc8de2133

Microsoft Word 2010 Service Pack 1 (64-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=d7227195-9360-42e3-88ee-620e967691c9

Microsoft Word 2010 Service Pack 2 (64-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=d7227195-9360-42e3-88ee-620e967691c9

Microsoft Word 2010 Service Pack 1 (64-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=e0d10c58-e4b7-49a8-b5be-94459d1a9b3b

Microsoft Word 2010 Service Pack 2 (64-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=e0d10c58-e4b7-49a8-b5be-94459d1a9b3b

Microsoft Word 2013 (32-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=908ed447-9196-48eb-a419-70fb5bc3afbc

Microsoft Word 2013 Service Pack 1 (32-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=908ed447-9196-48eb-a419-70fb5bc3afbc

Microsoft Word 2013 (64-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=062bc5fa-6979-40cf-8b9c-19c5cb27a9a2

Microsoft Word 2013 Service Pack 1 (64-bit editions):

http://www.microsoft.com/downloads/details.aspx?familyid=062bc5fa-6979-40cf-8b9c-19c5cb27a9a2

Microsoft Office for Mac 2011:

http://www.microsoft.com/downloads/details.aspx?familyid=78b06c3d-0158-4344-8a8b-5fb822cd44d8

Microsoft Word Viewer:

http://www.microsoft.com/downloads/details.aspx?familyid=1c256a78-f496-409d-a23d-ca7ba06a9a8c

Microsoft Office Compatibility Pack Service Pack 3:

http://www.microsoft.com/downloads/details.aspx?familyid=fa445aad-ecc5-4e14-8ed5-ee1ed08c9038

Microsoft SharePoint Server 2010 Service Pack 1 - Word Automation Services:

http://www.microsoft.com/downloads/details.aspx?familyid=7106687c-ca0c-476f-894b-21825adb093e

Microsoft SharePoint Server 2010 Service Pack 2 - Word Automation Services:

http://www.microsoft.com/downloads/details.aspx?familyid=7106687c-ca0c-476f-894b-21825adb093e

Microsoft SharePoint Server 2013 - Word Automation Services:

http://www.microsoft.com/downloads/details.aspx?familyid=f13f60f4-e253-4eba-b6dd-7fef876587ec

Microsoft SharePoint Server 2013 Service Pack 1 - Word Automation Services:

http://www.microsoft.com/downloads/details.aspx?familyid=f13f60f4-e253-4eba-b6dd-7fef876587ec

Microsoft Web Applications 2010 Service Pack 1:

http://www.microsoft.com/downloads/details.aspx?familyid=28ac8719-f3e4-4084-aafd-d5e1b1cad21b

Microsoft Web Applications 2010 Service Pack 2:

http://www.microsoft.com/downloads/details.aspx?familyid=28ac8719-f3e4-4084-aafd-d5e1b1cad21b

Microsoft Office Web Apps Server 2013:

http://www.microsoft.com/downloads/details.aspx?familyid=ecd2011c-6e06-494b-874a-c1c9d9faf5cd

A restart may be required.

The Microsoft advisory is available at:

http://technet.microsoft.com/en-us/security/bulletin/ms14-017

Vendor URL:  technet.microsoft.com/en-us/security/bulletin/ms14-017 (Links to External Site)
Cause:   Access control error, Boundary error
Underlying OS:  UNIX (macOS/OS X), Windows (Any)

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC