Microsoft Outlook App for Mac CVE-2015-1639 Cross Site Scripting Vulnerability

Bugtraq ID:	73991
Class:	Input Validation Error
CVE:	CVE-2015-1639
Remote:	Yes
Local:	No
Published:	Apr 14 2015 12:00AM
Updated:	Apr 14 2015 12:00AM
Credit:	Microsoft
Vulnerable:	Microsoft Office for Mac 2011 Apple Mac OS X 10.5.8
Not Vulnerable:	Microsoft Office for Mac 2011 14.4.8

Microsoft Outlook App for Mac CVE-2015-1639 Cross Site Scripting Vulnerability

Microsoft Outlook App for Mac is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Microsoft Outlook App for Mac CVE-2015-1639 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Microsoft Office for Mac 2011

• Microsoft Outlook for Mac for Office 365
  https://www.microsoft.com/downloads/details.aspx?FamilyId=65542ae1-62b 8-41d8-b5ed-3a51194acb73

Microsoft Outlook App for Mac CVE-2015-1639 Cross Site Scripting Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Outlook App for Mac Product Page (Microsoft)
  
• Microsoft Security Bulletin MS15-033 (Microsoft)