Microsoft Office CVE-2015-1641 Memory Corruption Vulnerability

Bugtraq ID:	73995
Class:	Unknown
CVE:	CVE-2015-1641
Remote:	Yes
Local:	No
Published:	Apr 14 2015 12:00AM
Updated:	Jul 13 2017 05:06PM
Credit:	Microsoft
Vulnerable:	Microsoft Word for Mac 2011 0 Microsoft Word Automation Services on Microsoft SharePoint Server 2013 Service Pack 1 Microsoft Word Automation Services on Microsoft SharePoint Server 2010 SP2 0 Microsoft Word 2013 Service Pack 1 (64-bit editions) Microsoft Word 2013 Service Pack 1 (32-bit editions) Microsoft Word 2013 RT Service Pack 1 0 Microsoft Word 2010 Service Pack 2 (64-bit editions) 0 Microsoft Word 2010 Service Pack 2 (32-bit editions) 0 Microsoft Word 2007 SP3 Microsoft Office Web Apps Server 2013 SP1 Microsoft Office Web Apps Server 2010 Service Pack 2 Microsoft Office Compatibility Pack SP3 Microsoft Office 2010 (64-bit edition) SP2 Microsoft Office 2010 (32-bit edition) SP2
Not Vulnerable:

Microsoft Office CVE-2015-1641 Memory Corruption Vulnerability

Microsoft Office is prone to a remote memory-corruption vulnerability.

An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will likely result in denial-of-service conditions.

Microsoft Office CVE-2015-1641 Memory Corruption Vulnerability

This vulnerability is being exploited as part of multiple cyber espionage and cybercrime campaigns identified in Symantec MATI reports SYMC - 300377, SYMC - 300451, SYMC - 300503, SYMC - 300514, SYMC - 300611, and SYMC - 300615.

Microsoft Office CVE-2015-1641 Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Microsoft Word 2013 Service Pack 1 (32-bit editions)

• Microsoft Security Update for Microsoft Word 2013 (KB2965224) 32-Bit Edition
  https://www.microsoft.com/downloads/details.aspx?FamilyId=2c4bcf40-ff3 7-49af-b641-207bfc997936

Microsoft Word 2007 SP3

• Microsoft Security Update for Microsoft Office Word 2007 (KB2965284)
  https://www.microsoft.com/downloads/details.aspx?FamilyId=73f5dfd3-bd5 5-495a-b822-b6afb00ed368

Microsoft Word 2010 Service Pack 2 (64-bit editions) 0

• Microsoft Security Update for Microsoft Word 2010 (KB2553428) 64-Bit Edition
  https://www.microsoft.com/downloads/details.aspx?FamilyId=be87fa00-9cf 6-47a3-863c-2ed92ad5a738

Microsoft Word for Mac 2011 0

• Microsoft Microsoft Office for Mac 2011 14.4.9 Update
  https://www.microsoft.com/downloads/details.aspx?FamilyId=1d9eec35-749 9-45e6-b403-936d84ec046b

Microsoft Office 2010 (32-bit edition) SP2

• Microsoft Security Update for Microsoft Office 2010 (KB2965236) 32-Bit Edition
  https://www.microsoft.com/downloads/details.aspx?FamilyId=9152b9ef-0ce 2-4f27-a70a-c753f0b12d05

Microsoft Word 2013 Service Pack 1 (64-bit editions)

• Microsoft Security Update for Microsoft Word 2013 (KB2965224) 64-Bit Edition
  https://www.microsoft.com/downloads/details.aspx?FamilyId=3bad7311-e0b d-417a-89b7-7b8378a1fc52

Microsoft Office Compatibility Pack SP3

• Microsoft Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB2965210)
  https://www.microsoft.com/downloads/details.aspx?FamilyId=daf8e168-032 7-4623-8183-e5071b81bbf2

Microsoft Word 2010 Service Pack 2 (32-bit editions) 0

• Microsoft Security Update for Microsoft Word 2010 (KB2553428) 32-Bit Edition
  https://www.microsoft.com/downloads/details.aspx?FamilyId=7614904a-99c 1-44fe-abf7-6dc7d365ef63

Microsoft Office CVE-2015-1641 Memory Corruption Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft Office Product Homepage (Microsoft)
  
• Microsoft Security Bulletin MS15-033 (Microsoft)