CVE-2017-11882 Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of th...
HighCVSS 7.8
EPSS 99.9%
CISA KEV
added 2021-11-03 · due 2022-05-03
Ransomware
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.
CISA Known Exploited Vulnerability
- Date added
- 2021-11-03
- Due date (FCEB)
- 2022-05-03
- Ransomware use
- Known
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft office | = 2007-sp3 | No fix listed |
| Microsoft office | = 2010-sp2 | No fix listed |
| Microsoft office | = 2013-sp1 | No fix listed |
| Microsoft office | = 2016 | No fix listed |
| Microsoft Office | = Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, Microsoft Office 2016 | No fix listed |
References
- reversingminds-blog.logdown.com exploit third-party-advisory
- 101757 third-party-advisory vdb-entry
- 1039783 third-party-advisory vdb-entry
- 0patch.blogspot.com exploit third-party-advisory
- 0patch.blogspot.com exploit patch third-party-advisory
- github.com exploit third-party-advisory
- github.com exploit third-party-advisory
- github.com exploit third-party-advisory
- github.com exploit third-party-advisory
- portal.msrc.microsoft.com patch vendor-advisory
- researchcenter.paloaltonetworks.com exploit third-party-advisory
- web.archive.org exploit mitigation third-party-advisory
- 43163 exploit third-party-advisory vdb-entry
- VU#421280 third-party-advisory us-government-resource
- www.cisa.gov government-resource us-government-resource