CVE-2018-0862 - Vulnerability Details

Vendors	Products
Microsoft	Office Office Compatibility Pack Word

Link	Providers
http://www.securityfocus.com/bid/102749
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0862

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Equation Editor", "vendor": "Microsoft Corporation", "versions": [{"status": "affected", "version": "Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016"}]}], "datePublic": "2018-01-19T00:00:00", "descriptions": [{"lang": "en", "value": "Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka \"Microsoft Word Remote Code Execution Vulnerability\". This CVE is unique from CVE-2018-0805, CVE-2018-0806, and CVE-2018-0807."}], "problemTypes": [{"descriptions": [{"description": "Remote Code Execution", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-23T10:57:01", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0862"}, {"name": "102749", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/102749"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@microsoft.com", "DATE_PUBLIC": "2018-01-19T00:00:00", "ID": "CVE-2018-0862", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Equation Editor", "version": {"version_data": [{"version_value": "Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016"}]}}]}, "vendor_name": "Microsoft Corporation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka \"Microsoft Word Remote Code Execution Vulnerability\". This CVE is unique from CVE-2018-0805, CVE-2018-0806, and CVE-2018-0807."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Remote Code Execution"}]}]}, "references": {"reference_data": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0862", "refsource": "CONFIRM", "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0862"}, {"name": "102749", "refsource": "BID", "url": "http://www.securityfocus.com/bid/102749"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T03:44:10.970Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0862"}, {"name": "102749", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/102749"}]}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2018-0862", "datePublished": "2018-01-22T23:00:00Z", "dateReserved": "2017-12-01T00:00:00", "dateUpdated": "2024-09-17T02:41:27.879Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Equation Editor (string)

vendor : Microsoft Corporation (string)

versions : [ »

0 : { »

status : affected (string)

version : Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 (string)

}

]

}

]

datePublic : 2018-01-19T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0805, CVE-2018-0806, and CVE-2018-0807. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Remote Code Execution (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2018-01-23T10:57:01 (string)

orgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

shortName : microsoft (string)

}

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0862 (string)

}

1 : { »

name : 102749 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

]

url : http://www.securityfocus.com/bid/102749 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : secure@microsoft.com (string)

DATE_PUBLIC : 2018-01-19T00:00:00 (string)

ID : CVE-2018-0862 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Equation Editor (string)

version : { »

version_data : [ »

0 : { »

version_value : Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 (string)

}

]

}

]

}

vendor_name : Microsoft Corporation (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0805, CVE-2018-0806, and CVE-2018-0807. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Remote Code Execution (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0862 (string)

refsource : CONFIRM (string)

url : https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0862 (string)

}

1 : { »

name : 102749 (string)

refsource : BID (string)

url : http://www.securityfocus.com/bid/102749 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T03:44:10.970Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0862 (string)

}

1 : { »

name : 102749 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

2 : x_transferred (string)

]

url : http://www.securityfocus.com/bid/102749 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

assignerShortName : microsoft (string)

cveId : CVE-2018-0862 (string)

datePublished : 2018-01-22T23:00:00Z (string)

dateReserved : 2017-12-01T00:00:00 (string)

dateUpdated : 2024-09-17T02:41:27.879Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*", "matchCriteriaId": "FEECD12A-5BEF-4675-B62E-86CF4A7474D7", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*", "matchCriteriaId": "081DE1E3-4622-4C32-8B9C-9AEC1CD20638", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*", "matchCriteriaId": "120690A6-E0A1-4E36-A35A-C87109ECC064", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*", "matchCriteriaId": "E0B3B0BC-C7C6-4687-AD72-DCA29FF9AE3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:click-to-run:*:*:*", "matchCriteriaId": "E74CB3D6-B0D7-4A6C-ABAA-170C7710D856", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*", "matchCriteriaId": "71AF058A-2E5D-4B11-88DB-8903C64B13C1", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*", "matchCriteriaId": "7D006508-BFB0-4F21-A361-3DA644F51D8A", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*", "matchCriteriaId": "24EEDAD9-9656-4B21-82E4-D60B83777492", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:*", "matchCriteriaId": "32E1400A-836A-4E48-B2CD-2B0A9A8241BA", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*", "matchCriteriaId": "45E21528-4B0F-4A6F-82AD-DF7FDBF67C8F", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*", "matchCriteriaId": "4DA042D4-B14E-4DDF-8423-DFB255679EFE", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka \"Microsoft Word Remote Code Execution Vulnerability\". This CVE is unique from CVE-2018-0805, CVE-2018-0806, and CVE-2018-0807."}, {"lang": "es", "value": "Equation Editor en Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013 y Microsoft Office 2016 permite una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo debido a la forma en la que se gestionan los objetos en la memoria. Esto tambi\u00e9n se conoce como \"Microsoft Word Remote Code Execution Vulnerability\". El ID de este CVE es diferente de CVE-2018-0805, CVE-2018-0806 y CVE-2018-0807."}], "id": "CVE-2018-0862", "lastModified": "2024-11-21T03:39:06.937", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-01-22T23:29:00.507", "references": [{"source": "secure@microsoft.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/102749"}, {"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0862"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/102749"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0862"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:* (string)

matchCriteriaId : FEECD12A-5BEF-4675-B62E-86CF4A7474D7 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:* (string)

matchCriteriaId : 081DE1E3-4622-4C32-8B9C-9AEC1CD20638 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:* (string)

matchCriteriaId : 120690A6-E0A1-4E36-A35A-C87109ECC064 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:* (string)

matchCriteriaId : E0B3B0BC-C7C6-4687-AD72-DCA29FF9AE3A (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:microsoft:office:2016:*:*:*:click-to-run:*:*:* (string)

matchCriteriaId : E74CB3D6-B0D7-4A6C-ABAA-170C7710D856 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:* (string)

matchCriteriaId : 71AF058A-2E5D-4B11-88DB-8903C64B13C1 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:* (string)

matchCriteriaId : 7D006508-BFB0-4F21-A361-3DA644F51D8A (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:* (string)

matchCriteriaId : 24EEDAD9-9656-4B21-82E4-D60B83777492 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:* (string)

matchCriteriaId : 32E1400A-836A-4E48-B2CD-2B0A9A8241BA (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:* (string)

matchCriteriaId : 45E21528-4B0F-4A6F-82AD-DF7FDBF67C8F (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:* (string)

matchCriteriaId : 4DA042D4-B14E-4DDF-8423-DFB255679EFE (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0805, CVE-2018-0806, and CVE-2018-0807. (string)

}

1 : { »

lang : es (string)

value : Equation Editor en Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013 y Microsoft Office 2016 permite una vulnerabilidad de ejecución remota de código debido a la forma en la que se gestionan los objetos en la memoria. Esto también se conoce como "Microsoft Word Remote Code Execution Vulnerability". El ID de este CVE es diferente de CVE-2018-0805, CVE-2018-0806 y CVE-2018-0807. (string)

}

]

id : CVE-2018-0862 (string)

lastModified : 2024-11-21T03:39:06.937 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : HIGH (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : COMPLETE (string)

baseScore : 9.3 (number)

confidentialityImpact : COMPLETE (string)

integrityImpact : COMPLETE (string)

vectorString : AV:N/AC:M/Au:N/C:C/I:C/A:C (string)

version : 2.0 (string)

}

exploitabilityScore : 8.6 (number)

impactScore : 10 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : true (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.0 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2018-01-22T23:29:00.507 (string)

references : [ »

0 : { »

source : secure@microsoft.com (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securityfocus.com/bid/102749 (string)

}

1 : { »

source : secure@microsoft.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0862 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securityfocus.com/bid/102749 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0862 (string)

}

]

sourceIdentifier : secure@microsoft.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object