Microsoft Patches Two Dozen code to be run remotely Flaws in Office

What happened

Word received the majority of patches, with only a few rolled out for Excel, Outlook, PowerPoint (sketch from Saturday Night Live), and SharePoint (Stack Exchange site for SharePoint enthusiasts). In addition to RCE (running programs on a machine from somewhere else) flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in Office. Microsoft is a software and software development company based in Redmond.

The post Microsoft Patches Two Dozen RCE Flaws in Office appeared first on SecurityWeek . Vulnerabilities Microsoft Patches Two Dozen RCE Flaws in Office In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in Office.

Most of the new fixes address security defects in the Office suite. Two dozen of them patch high-severity remote code execution (RCE) flaws, including half a dozen bugs that could be targeted via the Preview Pane.

In most cases, exploitation requires an attacker to send a specially crafted file, such as a malicious document, and convince the recipient to open it. Buffer overflow issues are blamed for most of the RCEs, with several defects being off-by-one, use-after-free, path traversal, and numeric truncation errors. In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in the Office suite.

Key facts

• In most cases, exploitation — requires: an attacker to send a specially crafted file, such as a malicious document, and convince the recipient to open it