Vulnerability Details CVE-2018-0798
Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Office Memory Corruption Vulnerability".
Exploit prediction scoring system (EPSS) score
EPSS Score 0.942
EPSS Ranking 99.9%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 9.3
Proposed Action
Microsoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.
Ransomware Campaign
Unknown
References
- http://www.securityfocus.com/bid/102370
- http://www.securitytracker.com/id/1040153
- https://0patch.blogspot.com/2018/01/bringing-abandoned-equation-editor-back.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0798
- http://www.securityfocus.com/bid/102370
- http://www.securitytracker.com/id/1040153
- https://0patch.blogspot.com/2018/01/bringing-abandoned-equation-editor-back.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0798
Products affected by CVE-2018-0798
-
cpe:2.3:a:microsoft:office:2007
-
cpe:2.3:a:microsoft:office:2010
-
cpe:2.3:a:microsoft:office:2013
-
cpe:2.3:a:microsoft:office:2016
-
cpe:2.3:a:microsoft:office_compatibility_pack:-
-
cpe:2.3:a:microsoft:word:2007
-
cpe:2.3:a:microsoft:word:2010
-
cpe:2.3:a:microsoft:word:2013
-
cpe:2.3:a:microsoft:word:2016