{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Windows Server 2019 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 2004 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2022",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 pour syst\u00e8mes x64 Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2022 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 pour syst\u00e8mes 32 bits Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows RT 8.1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 20H2 (Server Core Installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2022-05-04",
  "content": "## Contournement provisoire\n\n**\\[Version du 15 septembre 2021\\]** il est recommand\u00e9 d\u0027annuler le\ncontournement afin de revenir au fonctionnement nominal.\n\n\u003cs\u003eDans son avis, Microsoft propose une mesure de contournement en\nattendant la sortie du correctif.\u003c/s\u003e\n\n\u003cs\u003eLa modification du registre propos\u00e9e emp\u00eache l\u0027installation de\nnouveaux contr\u00f4les ActiveX. Celle-ci est r\u00e9versible.\u003c/s\u003e\n",
  "cves": [
    {
      "name": "CVE-2021-40444",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-40444"
    }
  ],
  "links": [
    {
      "title": "Avis CERT-FR CERTFR-2021-AVI-710 du 15 septembre 2021",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2021-AVI-710/"
    }
  ],
  "reference": "CERTFR-2021-ALE-019",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-09-08T00:00:00.000000"
    },
    {
      "description": "Ajout du lien vers l\u0027avis CERT-FR",
      "revision_date": "2021-09-15T00:00:00.000000"
    },
    {
      "description": "section \u0027contournement\u0027 corrig\u00e9e",
      "revision_date": "2021-11-18T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2022-05-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "\u003cstrong\u003e\\[Version du 15 septembre 2021\\]\u003c/strong\u003e Dans le cadre de son *Patch\nTuesday*, en date du 14 septembre 2021, Microsoft a mis \u00e0 disposition un\ncorrectif pour cette vuln\u00e9rabilit\u00e9. Le CERT-FR recommande fortement\nd\u0027appliquer ce correctif et, le cas \u00e9ch\u00e9ant, d\u0027enlever les\ncontournements pr\u00e9alablement appliqu\u00e9s pour se prot\u00e9ger de cette\nvuln\u00e9rabilit\u00e9.\n\n\u003cstrong\u003e\\[Version initiale\\]\u003c/strong\u003e\n\nCelle-ci affecte le composant MSHTML utilis\u00e9 par ActiveX. Un attaquant\npeut obtenir une ex\u00e9cution de code arbitraire \u00e0 distance en envoyant un\nfichier Office pi\u00e9g\u00e9.\n\nCette ex\u00e9cution de code s\u0027effectue avec les niveaux de privil\u00e8ges de\nl\u0027utilisateur ayant ouvert le document.\n\nAucun correctif n\u0027est disponible.\n\nMicrosoft indique \u00e9galement que cette vuln\u00e9rabilit\u00e9 est activement\nexploit\u00e9e dans le cadre d\u0027attaques cibl\u00e9es.\n",
  "title": "[MaJ] Vuln\u00e9rabilit\u00e9 dans Microsoft Windows",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-40444 du 07 septembre 2021",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Windows Server 2019 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 2004 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2022",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 pour syst\u00e8mes x64 Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2022 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 pour syst\u00e8mes 32 bits Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows RT 8.1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 20H2 (Server Core Installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2022-05-04",
  "content": "## Contournement provisoire\n\n**\\[Version du 15 septembre 2021\\]** il est recommand\u00e9 d\u0027annuler le\ncontournement afin de revenir au fonctionnement nominal.\n\n\u003cs\u003eDans son avis, Microsoft propose une mesure de contournement en\nattendant la sortie du correctif.\u003c/s\u003e\n\n\u003cs\u003eLa modification du registre propos\u00e9e emp\u00eache l\u0027installation de\nnouveaux contr\u00f4les ActiveX. Celle-ci est r\u00e9versible.\u003c/s\u003e\n",
  "cves": [
    {
      "name": "CVE-2021-40444",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-40444"
    }
  ],
  "links": [
    {
      "title": "Avis CERT-FR CERTFR-2021-AVI-710 du 15 septembre 2021",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2021-AVI-710/"
    }
  ],
  "reference": "CERTFR-2021-ALE-019",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-09-08T00:00:00.000000"
    },
    {
      "description": "Ajout du lien vers l\u0027avis CERT-FR",
      "revision_date": "2021-09-15T00:00:00.000000"
    },
    {
      "description": "section \u0027contournement\u0027 corrig\u00e9e",
      "revision_date": "2021-11-18T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2022-05-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "\u003cstrong\u003e\\[Version du 15 septembre 2021\\]\u003c/strong\u003e Dans le cadre de son *Patch\nTuesday*, en date du 14 septembre 2021, Microsoft a mis \u00e0 disposition un\ncorrectif pour cette vuln\u00e9rabilit\u00e9. Le CERT-FR recommande fortement\nd\u0027appliquer ce correctif et, le cas \u00e9ch\u00e9ant, d\u0027enlever les\ncontournements pr\u00e9alablement appliqu\u00e9s pour se prot\u00e9ger de cette\nvuln\u00e9rabilit\u00e9.\n\n\u003cstrong\u003e\\[Version initiale\\]\u003c/strong\u003e\n\nCelle-ci affecte le composant MSHTML utilis\u00e9 par ActiveX. Un attaquant\npeut obtenir une ex\u00e9cution de code arbitraire \u00e0 distance en envoyant un\nfichier Office pi\u00e9g\u00e9.\n\nCette ex\u00e9cution de code s\u0027effectue avec les niveaux de privil\u00e8ges de\nl\u0027utilisateur ayant ouvert le document.\n\nAucun correctif n\u0027est disponible.\n\nMicrosoft indique \u00e9galement que cette vuln\u00e9rabilit\u00e9 est activement\nexploit\u00e9e dans le cadre d\u0027attaques cibl\u00e9es.\n",
  "title": "[MaJ] Vuln\u00e9rabilit\u00e9 dans Microsoft Windows",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2021-40444 du 07 septembre 2021",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444"
    }
  ]
}

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-40444"
    }
  },
  "description": "MSHTML\uff08\u53c8\u79f0\u4e3aTrident\uff09\u662f\u5fae\u8f6f\u65d7\u4e0b\u7684Internet Explorer\u6d4f\u89c8\u5668\u5f15\u64ce\uff0c\u867d\u7136MHTML\u4e3b\u8981\u7528\u4e8e\u5df2\u88ab\u5f03\u7528\u7684Internet Explorer\u6d4f\u89c8\u5668\uff0c\u4f46\u8be5\u7ec4\u4ef6\u4e5f\u7528\u4e8eOffice\u5e94\u7528\u7a0b\u5e8f\uff0c\u4ee5\u5728 Word\u3001Excel\u6216PowerPoint\u6587\u6863\u4e2d\u5448\u73b0Web\u6258\u7ba1\u7684\u5185\u5bb9\u3002\n\nMicrosoft MSHTML\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u5236\u4f5c\u5e26\u6709\u6076\u610f ActiveX\u63a7\u4ef6\u7684Microsoft Office\u6587\u6863\u5e76\u8bf1\u5bfc\u7528\u6237\u6253\u5f00\u6b64\u6587\u6863\u6765\u5229\u7528\u6b64\u6f0f\u6d1e\u3002\u6210\u529f\u5229\u7528\u6b64\u6f0f\u6d1e\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5728\u76ee\u6807\u7cfb\u7edf\u4e0a\u4ee5\u8be5\u7528\u6237\u6743\u9650\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-69088",
  "openTime": "2021-09-08",
  "patchDescription": "MSHTML\uff08\u53c8\u79f0\u4e3aTrident\uff09\u662f\u5fae\u8f6f\u65d7\u4e0b\u7684Internet Explorer\u6d4f\u89c8\u5668\u5f15\u64ce\uff0c\u867d\u7136MHTML\u4e3b\u8981\u7528\u4e8e\u5df2\u88ab\u5f03\u7528\u7684Internet Explorer\u6d4f\u89c8\u5668\uff0c\u4f46\u8be5\u7ec4\u4ef6\u4e5f\u7528\u4e8eOffice\u5e94\u7528\u7a0b\u5e8f\uff0c\u4ee5\u5728 Word\u3001Excel\u6216PowerPoint\u6587\u6863\u4e2d\u5448\u73b0Web\u6258\u7ba1\u7684\u5185\u5bb9\u3002\r\n\r\nMicrosoft MSHTML\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u901a\u8fc7\u5236\u4f5c\u5e26\u6709\u6076\u610f ActiveX\u63a7\u4ef6\u7684Microsoft Office\u6587\u6863\u5e76\u8bf1\u5bfc\u7528\u6237\u6253\u5f00\u6b64\u6587\u6863\u6765\u5229\u7528\u6b64\u6f0f\u6d1e\u3002\u6210\u529f\u5229\u7528\u6b64\u6f0f\u6d1e\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5728\u76ee\u6807\u7cfb\u7edf\u4e0a\u4ee5\u8be5\u7528\u6237\u6743\u9650\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft MSHTML\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Windows Server 2008 R2",
      "Microsoft Windows 7 SP1",
      "Microsoft Windows 8.1",
      "Microsoft Windows RT 8.1 SP0",
      "Microsoft Windows Server 2012 R2",
      "Microsoft Windows 10 1607",
      "Microsoft Windows Server 2016",
      "Microsoft Windows Server 2012",
      "Microsoft Windows 10",
      "Microsoft Windows Server 2008 SP2",
      "Microsoft Windows Server 2019",
      "Microsoft Windows Server 2022 null",
      "Microsoft Windows 10 1809",
      "Microsoft Windows 10 1909",
      "Microsoft Windows Server 2004",
      "Microsoft Windows 10 2004",
      "Microsoft Windows 10 20H2",
      "Microsoft Windows Server 20H2",
      "Microsoft Windows 10 21H1"
    ]
  },
  "referenceLink": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444",
  "serverity": "\u9ad8",
  "submitTime": "2021-09-08",
  "title": "Microsoft MSHTML\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e"
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Windows Server 2022",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 2004 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2022 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows RT 8.1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 pour syst\u00e8mes x64 Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 20H2 (Server Core Installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 pour syst\u00e8mes 32 bits Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-36975",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36975"
    },
    {
      "name": "CVE-2021-36973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36973"
    },
    {
      "name": "CVE-2021-38629",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38629"
    },
    {
      "name": "CVE-2021-38625",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38625"
    },
    {
      "name": "CVE-2021-38624",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38624"
    },
    {
      "name": "CVE-2021-36963",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36963"
    },
    {
      "name": "CVE-2021-38638",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38638"
    },
    {
      "name": "CVE-2021-26435",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-26435"
    },
    {
      "name": "CVE-2021-38635",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38635"
    },
    {
      "name": "CVE-2021-36965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36965"
    },
    {
      "name": "CVE-2021-36961",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36961"
    },
    {
      "name": "CVE-2021-38671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38671"
    },
    {
      "name": "CVE-2021-36966",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36966"
    },
    {
      "name": "CVE-2021-36959",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36959"
    },
    {
      "name": "CVE-2021-38630",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38630"
    },
    {
      "name": "CVE-2021-38637",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38637"
    },
    {
      "name": "CVE-2021-36955",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36955"
    },
    {
      "name": "CVE-2021-38634",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38634"
    },
    {
      "name": "CVE-2021-36962",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36962"
    },
    {
      "name": "CVE-2021-36954",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36954"
    },
    {
      "name": "CVE-2021-38632",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38632"
    },
    {
      "name": "CVE-2021-38639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38639"
    },
    {
      "name": "CVE-2021-36972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36972"
    },
    {
      "name": "CVE-2021-36960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36960"
    },
    {
      "name": "CVE-2021-36974",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36974"
    },
    {
      "name": "CVE-2021-38633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38633"
    },
    {
      "name": "CVE-2021-36958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36958"
    },
    {
      "name": "CVE-2021-36968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36968"
    },
    {
      "name": "CVE-2021-38628",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38628"
    },
    {
      "name": "CVE-2021-40447",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-40447"
    },
    {
      "name": "CVE-2021-36964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36964"
    },
    {
      "name": "CVE-2021-38667",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38667"
    },
    {
      "name": "CVE-2021-40444",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-40444"
    },
    {
      "name": "CVE-2021-36967",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36967"
    },
    {
      "name": "CVE-2021-38636",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38636"
    },
    {
      "name": "CVE-2021-36969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36969"
    },
    {
      "name": "CVE-2021-38626",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38626"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-710",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-09-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Usurpation d\u0027identit\u00e9"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Microsoft Windows.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Windows",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 14 septembre 2021",
      "url": "https://msrc.microsoft.com/update-guide/"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Windows Server 2022",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 2004 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2022 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows RT 8.1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H1 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 pour syst\u00e8mes x64 Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1909 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 2004 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 8.1 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server, version 20H2 (Server Core Installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 20H2 pour ARM64-based Systems",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 7 pour syst\u00e8mes 32 bits Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-36975",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36975"
    },
    {
      "name": "CVE-2021-36973",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36973"
    },
    {
      "name": "CVE-2021-38629",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38629"
    },
    {
      "name": "CVE-2021-38625",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38625"
    },
    {
      "name": "CVE-2021-38624",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38624"
    },
    {
      "name": "CVE-2021-36963",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36963"
    },
    {
      "name": "CVE-2021-38638",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38638"
    },
    {
      "name": "CVE-2021-26435",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-26435"
    },
    {
      "name": "CVE-2021-38635",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38635"
    },
    {
      "name": "CVE-2021-36965",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36965"
    },
    {
      "name": "CVE-2021-36961",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36961"
    },
    {
      "name": "CVE-2021-38671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38671"
    },
    {
      "name": "CVE-2021-36966",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36966"
    },
    {
      "name": "CVE-2021-36959",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36959"
    },
    {
      "name": "CVE-2021-38630",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38630"
    },
    {
      "name": "CVE-2021-38637",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38637"
    },
    {
      "name": "CVE-2021-36955",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36955"
    },
    {
      "name": "CVE-2021-38634",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38634"
    },
    {
      "name": "CVE-2021-36962",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36962"
    },
    {
      "name": "CVE-2021-36954",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36954"
    },
    {
      "name": "CVE-2021-38632",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38632"
    },
    {
      "name": "CVE-2021-38639",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38639"
    },
    {
      "name": "CVE-2021-36972",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36972"
    },
    {
      "name": "CVE-2021-36960",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36960"
    },
    {
      "name": "CVE-2021-36974",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36974"
    },
    {
      "name": "CVE-2021-38633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38633"
    },
    {
      "name": "CVE-2021-36958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36958"
    },
    {
      "name": "CVE-2021-36968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36968"
    },
    {
      "name": "CVE-2021-38628",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38628"
    },
    {
      "name": "CVE-2021-40447",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-40447"
    },
    {
      "name": "CVE-2021-36964",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36964"
    },
    {
      "name": "CVE-2021-38667",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38667"
    },
    {
      "name": "CVE-2021-40444",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-40444"
    },
    {
      "name": "CVE-2021-36967",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36967"
    },
    {
      "name": "CVE-2021-38636",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38636"
    },
    {
      "name": "CVE-2021-36969",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-36969"
    },
    {
      "name": "CVE-2021-38626",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-38626"
    }
  ],
  "links": [],
  "reference": "CERTFR-2021-AVI-710",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-09-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Usurpation d\u0027identit\u00e9"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Microsoft Windows.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire \u00e0 distance, un contournement de la\npolitique de s\u00e9curit\u00e9 et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Windows",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 14 septembre 2021",
      "url": "https://msrc.microsoft.com/update-guide/"
    }
  ]
}

{
  "cisaActionDue": "2021-11-17",
  "cisaExploitAdd": "2021-11-03",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Microsoft MSHTML Remote Code Execution Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C1658517-428C-4FAF-8EEE-3FD68557AAD1",
              "versionEndExcluding": "10.0.10240.19060",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4BF6C51E-7240-457D-A36C-5494AEE41AB1",
              "versionEndExcluding": "10.0.14393.4651",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1673EF18-FB21-450C-B75D-89279B6779FA",
              "versionEndExcluding": "10.0.17763.2183",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3F77B0B-2A62-4E21-B042-BB86ABA68BE3",
              "versionEndExcluding": "10.0.18363.1801",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F4E719E7-7D50-49F6-ABD4-77B1F7ECC68C",
              "versionEndExcluding": "10.0.19041.1237",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "71B3072F-0DB3-4C23-AD96-62BF71345E61",
              "versionEndExcluding": "10.0.19042.1237",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CB038EC1-8E36-48C1-8E2E-3B8B6585D25E",
              "versionEndExcluding": "10.0.19043.1237",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "C2B1C231-DE19-4B8F-A4AA-5B3A65276E46",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E93068DB-549B-45AB-8E5C-00EB5D8B5CF8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6CE5198-C498-4672-AF4C-77AB4BE06C5C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2004:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "046119DC-43BF-4077-9721-12E2EFD7F492",
              "versionEndExcluding": "10.0.19041.1237",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "5F422A8C-2C4E-42C8-B420-E0728037E15C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*",
              "matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:r2:*:*:*:*:*:*",
              "matchCriteriaId": "5F2558DF-2D1F-46BA-ABF1-08522D33268E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EAF9D18C-B459-48F2-8451-20E7B04EAD36",
              "versionEndExcluding": "10.0.14393.4651",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8867C828-131C-466E-9A35-80184659D540",
              "versionEndExcluding": "10.0.17763.2183",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "0663409D-4AE8-4BD9-85FE-9EAED15AE9DB",
              "versionEndExcluding": "10.0.20348.230",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "292B87C7-3AC9-48FF-91D7-21D6D74C84A9",
              "versionEndExcluding": "10.0.19042.1237",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "\u003cp\u003eMicrosoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents.\u003c/p\u003e\n\u003cp\u003eAn attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.\u003c/p\u003e\n\u003cp\u003eMicrosoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: \u201cSuspicious Cpl File Execution\u201d.\u003c/p\u003e\n\u003cp\u003eUpon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.\u003c/p\u003e\n\u003cp\u003ePlease see the \u003cstrong\u003eMitigations\u003c/strong\u003e and \u003cstrong\u003eWorkaround\u003c/strong\u003e sections for important information about steps you can take to protect your system from this vulnerability.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eUPDATE\u003c/strong\u003e September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. Please see the FAQ for important information about which updates are applicable to your system.\u003c/p\u003e\n"
    },
    {
      "lang": "es",
      "value": "Una Vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota de Microsoft MSHTML"
    }
  ],
  "id": "CVE-2021-40444",
  "lastModified": "2025-10-30T19:16:25.180",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.3,
        "source": "secure@microsoft.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Secondary"
      }
    ]
  },
  "published": "2021-09-15T12:15:16.467",
  "references": [
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/164210/Microsoft-Windows-MSHTML-Overview.html"
    },
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/165214/Microsoft-Office-Word-MSHTML-Remote-Code-Execution.html"
    },
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/167317/Microsoft-Office-MSDT-Follina-Proof-Of-Concept.html"
    },
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/164210/Microsoft-Windows-MSHTML-Overview.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/165214/Microsoft-Office-Word-MSHTML-Remote-Code-Execution.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://packetstormsecurity.com/files/167317/Microsoft-Office-MSDT-Follina-Proof-Of-Concept.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40444"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-40444"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-09-15T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "Microsoft MSHTML Remote Code Execution Vulnerability",
  "id": "GHSA-2h32-fhf6-xhh5",
  "modified": "2025-10-22T00:32:20Z",
  "published": "2022-05-24T19:14:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40444"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-40444"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/164210/Microsoft-Windows-MSHTML-Overview.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/165214/Microsoft-Office-Word-MSHTML-Remote-Code-Execution.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/167317/Microsoft-Office-MSDT-Follina-Proof-Of-Concept.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2021-40444",
    "description": "Microsoft MSHTML Remote Code Execution Vulnerability",
    "id": "GSD-2021-40444",
    "references": [
      "https://packetstormsecurity.com/files/cve/CVE-2021-40444"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-40444"
      ],
      "details": "Microsoft MSHTML Remote Code Execution Vulnerability",
      "id": "GSD-2021-40444",
      "modified": "2023-12-13T01:23:25.377535Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cisa.gov": {
      "cveID": "CVE-2021-40444",
      "dateAdded": "2021-11-03",
      "dueDate": "2021-11-17",
      "product": "Microsoft MSHTML",
      "requiredAction": "Apply updates per vendor instructions.",
      "shortDescription": "Microsoft MSHTML Remote Code Execution Vulnerability",
      "vendorProject": "Microsoft",
      "vulnerabilityName": "Microsoft Windows, Server (spec. IE) All Arbitrary Code Execution"
    },
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secure@microsoft.com",
        "ID": "CVE-2021-40444",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Windows 10 Version 1809",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0",
                          "version_value": "10.0.17763.2183"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server 2019",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0",
                          "version_value": "10.0.17763.2183"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server 2019 (Server Core installation)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0",
                          "version_value": "10.0.17763.2183"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows 10 Version 1909",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0",
                          "version_value": "10.0.18363.1801"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows 10 Version 21H1",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0",
                          "version_value": "10.0.19043.1237"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server 2022",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0",
                          "version_value": "10.0.20348.230"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows 10 Version 2004",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0",
                          "version_value": "10.0.19041.1237"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server version 2004",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0",
                          "version_value": "10.0.19041.1237"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows 10 Version 20H2",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0",
                          "version_value": "10.0.19042.1237"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server version 20H2",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0",
                          "version_value": "10.0.19042.1237"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows 10 Version 1507",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0",
                          "version_value": "10.0.10240.19060"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows 10 Version 1607",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0",
                          "version_value": "10.0.14393.4651"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server 2016",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0",
                          "version_value": "10.0.14393.4651"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server 2016 (Server Core installation)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "10.0.0",
                          "version_value": "10.0.14393.4651"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows 7",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "6.1.0",
                          "version_value": "6.1.7601.25712"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows 7 Service Pack 1",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "6.1.0",
                          "version_value": "6.1.7601.25712"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows 8.1",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "6.3.0",
                          "version_value": "6.3.9600.20120"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server 2008 Service Pack 2",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "6.0.0",
                          "version_value": "6.0.6003.21218"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server 2008 Service Pack 2 (Server Core installation)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "6.0.0",
                          "version_value": "6.0.6003.21218"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server 2008  Service Pack 2",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "6.0.0",
                          "version_value": "6.0.6003.21218"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server 2008 R2 Service Pack 1",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "6.1.0",
                          "version_value": "6.1.7601.25712"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "6.0.0",
                          "version_value": "6.1.7601.25712"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server 2012",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "6.2.0",
                          "version_value": "6.2.9200.23462"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server 2012 (Server Core installation)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "6.2.0",
                          "version_value": "6.2.9200.23462"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server 2012 R2",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "6.3.0",
                          "version_value": "6.3.9600.20120"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Windows Server 2012 R2 (Server Core installation)",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "6.3.0",
                          "version_value": "6.3.9600.20120"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Microsoft"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "\u003cp\u003eMicrosoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents.\u003c/p\u003e\n\u003cp\u003eAn attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.\u003c/p\u003e\n\u003cp\u003eMicrosoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: \u201cSuspicious Cpl File Execution\u201d.\u003c/p\u003e\n\u003cp\u003eUpon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.\u003c/p\u003e\n\u003cp\u003ePlease see the \u003cstrong\u003eMitigations\u003c/strong\u003e and \u003cstrong\u003eWorkaround\u003c/strong\u003e sections for important information about steps you can take to protect your system from this vulnerability.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eUPDATE\u003c/strong\u003e September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. Please see the FAQ for important information about which updates are applicable to your system.\u003c/p\u003e\n"
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Remote Code Execution"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444",
            "refsource": "MISC",
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444"
          },
          {
            "name": "http://packetstormsecurity.com/files/164210/Microsoft-Windows-MSHTML-Overview.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/164210/Microsoft-Windows-MSHTML-Overview.html"
          },
          {
            "name": "http://packetstormsecurity.com/files/165214/Microsoft-Office-Word-MSHTML-Remote-Code-Execution.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/165214/Microsoft-Office-Word-MSHTML-Remote-Code-Execution.html"
          },
          {
            "name": "http://packetstormsecurity.com/files/167317/Microsoft-Office-MSDT-Follina-Proof-Of-Concept.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/167317/Microsoft-Office-MSDT-Follina-Proof-Of-Concept.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "cisaActionDue": "2021-11-17",
        "cisaExploitAdd": "2021-11-03",
        "cisaRequiredAction": "Apply updates per vendor instructions.",
        "cisaVulnerabilityName": "Microsoft MSHTML Remote Code Execution Vulnerability",
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "21540673-614A-4D40-8BD7-3F07723803B0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9E2C378B-1507-4C81-82F6-9F599616845A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FAE4278F-71A7-43E9-8F79-1CBFAE71D730",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E01A4CCA-4C43-46E0-90E6-3E4DBFBACD64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6B8F3DD2-A145-4AF1-8545-CC42892DA3D1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E9273B95-20ED-4547-B0A8-95AD15B30372",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AAE74AF3-C559-4645-A6C0-25C3D647AAC8",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:-:*:-:*",
                    "matchCriteriaId": "DCF7181C-41D5-46E6-8812-10A51CB208A6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:-:*:-:*",
                    "matchCriteriaId": "48032169-A0ED-4D24-85BE-D1FE1EEF9460",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C6CE5198-C498-4672-AF4C-77AB4BE06C5C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*",
                    "matchCriteriaId": "5F422A8C-2C4E-42C8-B420-E0728037E15C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*",
                    "matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:r2:*:*:*:*:*:*",
                    "matchCriteriaId": "5F2558DF-2D1F-46BA-ABF1-08522D33268E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_server_2016:20h2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4A190388-AA82-4504-9D5A-624F23268C9F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_server_2016:2004:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0B60D940-80C7-49F0-8F4E-3F99AC15FA82",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "DB79EE26-FC32-417D-A49C-A1A63165A968",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "821614DD-37DD-44E2-A8A4-FE8D23A33C3C",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "\u003cp\u003eMicrosoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents.\u003c/p\u003e\n\u003cp\u003eAn attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.\u003c/p\u003e\n\u003cp\u003eMicrosoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: \u201cSuspicious Cpl File Execution\u201d.\u003c/p\u003e\n\u003cp\u003eUpon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.\u003c/p\u003e\n\u003cp\u003ePlease see the \u003cstrong\u003eMitigations\u003c/strong\u003e and \u003cstrong\u003eWorkaround\u003c/strong\u003e sections for important information about steps you can take to protect your system from this vulnerability.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eUPDATE\u003c/strong\u003e September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. Please see the FAQ for important information about which updates are applicable to your system.\u003c/p\u003e\n"
          },
          {
            "lang": "es",
            "value": "Una Vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota de Microsoft MSHTML"
          }
        ],
        "id": "CVE-2021-40444",
        "lastModified": "2023-12-28T20:16:06.563",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 6.8,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.3,
              "source": "secure@microsoft.com",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Secondary"
            }
          ]
        },
        "published": "2021-09-15T12:15:16.467",
        "references": [
          {
            "source": "secure@microsoft.com",
            "tags": [
              "Exploit",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://packetstormsecurity.com/files/164210/Microsoft-Windows-MSHTML-Overview.html"
          },
          {
            "source": "secure@microsoft.com",
            "tags": [
              "Exploit",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://packetstormsecurity.com/files/165214/Microsoft-Office-Word-MSHTML-Remote-Code-Execution.html"
          },
          {
            "source": "secure@microsoft.com",
            "tags": [
              "Exploit",
              "Third Party Advisory",
              "VDB Entry"
            ],
            "url": "http://packetstormsecurity.com/files/167317/Microsoft-Office-MSDT-Follina-Proof-Of-Concept.html"
          },
          {
            "source": "secure@microsoft.com",
            "tags": [
              "Mitigation",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40444"
          }
        ],
        "sourceIdentifier": "secure@microsoft.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "python310-oletools-0.60.1-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the python310-oletools-0.60.1-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-13674",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_13674-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-40444 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-40444/"
      }
    ],
    "title": "python310-oletools-0.60.1-1.1 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:13674-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python310-oletools-0.60.1-1.1.aarch64",
                "product": {
                  "name": "python310-oletools-0.60.1-1.1.aarch64",
                  "product_id": "python310-oletools-0.60.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-oletools-0.60.1-1.1.aarch64",
                "product": {
                  "name": "python311-oletools-0.60.1-1.1.aarch64",
                  "product_id": "python311-oletools-0.60.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python312-oletools-0.60.1-1.1.aarch64",
                "product": {
                  "name": "python312-oletools-0.60.1-1.1.aarch64",
                  "product_id": "python312-oletools-0.60.1-1.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "python39-oletools-0.60.1-1.1.aarch64",
                "product": {
                  "name": "python39-oletools-0.60.1-1.1.aarch64",
                  "product_id": "python39-oletools-0.60.1-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python310-oletools-0.60.1-1.1.ppc64le",
                "product": {
                  "name": "python310-oletools-0.60.1-1.1.ppc64le",
                  "product_id": "python310-oletools-0.60.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python311-oletools-0.60.1-1.1.ppc64le",
                "product": {
                  "name": "python311-oletools-0.60.1-1.1.ppc64le",
                  "product_id": "python311-oletools-0.60.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python312-oletools-0.60.1-1.1.ppc64le",
                "product": {
                  "name": "python312-oletools-0.60.1-1.1.ppc64le",
                  "product_id": "python312-oletools-0.60.1-1.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "python39-oletools-0.60.1-1.1.ppc64le",
                "product": {
                  "name": "python39-oletools-0.60.1-1.1.ppc64le",
                  "product_id": "python39-oletools-0.60.1-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python310-oletools-0.60.1-1.1.s390x",
                "product": {
                  "name": "python310-oletools-0.60.1-1.1.s390x",
                  "product_id": "python310-oletools-0.60.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python311-oletools-0.60.1-1.1.s390x",
                "product": {
                  "name": "python311-oletools-0.60.1-1.1.s390x",
                  "product_id": "python311-oletools-0.60.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python312-oletools-0.60.1-1.1.s390x",
                "product": {
                  "name": "python312-oletools-0.60.1-1.1.s390x",
                  "product_id": "python312-oletools-0.60.1-1.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "python39-oletools-0.60.1-1.1.s390x",
                "product": {
                  "name": "python39-oletools-0.60.1-1.1.s390x",
                  "product_id": "python39-oletools-0.60.1-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python310-oletools-0.60.1-1.1.x86_64",
                "product": {
                  "name": "python310-oletools-0.60.1-1.1.x86_64",
                  "product_id": "python310-oletools-0.60.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python311-oletools-0.60.1-1.1.x86_64",
                "product": {
                  "name": "python311-oletools-0.60.1-1.1.x86_64",
                  "product_id": "python311-oletools-0.60.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python312-oletools-0.60.1-1.1.x86_64",
                "product": {
                  "name": "python312-oletools-0.60.1-1.1.x86_64",
                  "product_id": "python312-oletools-0.60.1-1.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "python39-oletools-0.60.1-1.1.x86_64",
                "product": {
                  "name": "python39-oletools-0.60.1-1.1.x86_64",
                  "product_id": "python39-oletools-0.60.1-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python310-oletools-0.60.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.aarch64"
        },
        "product_reference": "python310-oletools-0.60.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python310-oletools-0.60.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.ppc64le"
        },
        "product_reference": "python310-oletools-0.60.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python310-oletools-0.60.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.s390x"
        },
        "product_reference": "python310-oletools-0.60.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python310-oletools-0.60.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.x86_64"
        },
        "product_reference": "python310-oletools-0.60.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-oletools-0.60.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.aarch64"
        },
        "product_reference": "python311-oletools-0.60.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-oletools-0.60.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.ppc64le"
        },
        "product_reference": "python311-oletools-0.60.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-oletools-0.60.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.s390x"
        },
        "product_reference": "python311-oletools-0.60.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python311-oletools-0.60.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.x86_64"
        },
        "product_reference": "python311-oletools-0.60.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-oletools-0.60.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.aarch64"
        },
        "product_reference": "python312-oletools-0.60.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-oletools-0.60.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.ppc64le"
        },
        "product_reference": "python312-oletools-0.60.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-oletools-0.60.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.s390x"
        },
        "product_reference": "python312-oletools-0.60.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python312-oletools-0.60.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.x86_64"
        },
        "product_reference": "python312-oletools-0.60.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python39-oletools-0.60.1-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.aarch64"
        },
        "product_reference": "python39-oletools-0.60.1-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python39-oletools-0.60.1-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.ppc64le"
        },
        "product_reference": "python39-oletools-0.60.1-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python39-oletools-0.60.1-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.s390x"
        },
        "product_reference": "python39-oletools-0.60.1-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python39-oletools-0.60.1-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.x86_64"
        },
        "product_reference": "python39-oletools-0.60.1-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-40444",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-40444"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "\u003cp\u003eMicrosoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents.\u003c/p\u003e\n\u003cp\u003eAn attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine. The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.\u003c/p\u003e\n\u003cp\u003eMicrosoft Defender Antivirus and Microsoft Defender for Endpoint both provide detection and protections for the known vulnerability. Customers should keep antimalware products up to date. Customers who utilize automatic updates do not need to take additional action. Enterprise customers who manage updates should select the detection build 1.349.22.0 or newer and deploy it across their environments. Microsoft Defender for Endpoint alerts will be displayed as: \"Suspicious Cpl File Execution\".\u003c/p\u003e\n\u003cp\u003eUpon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.\u003c/p\u003e\n\u003cp\u003ePlease see the \u003cstrong\u003eMitigations\u003c/strong\u003e and \u003cstrong\u003eWorkaround\u003c/strong\u003e sections for important information about steps you can take to protect your system from this vulnerability.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eUPDATE\u003c/strong\u003e September 14, 2021: Microsoft has released security updates to address this vulnerability. Please see the Security Updates table for the applicable update for your system. We recommend that you install these updates immediately. Please see the FAQ for important information about which updates are applicable to your system.\u003c/p\u003e\n",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.aarch64",
          "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.s390x",
          "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.x86_64",
          "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.aarch64",
          "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.s390x",
          "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.x86_64",
          "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.aarch64",
          "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.s390x",
          "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.x86_64",
          "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.aarch64",
          "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.ppc64le",
          "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.s390x",
          "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-40444",
          "url": "https://www.suse.com/security/cve/CVE-2021-40444"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.aarch64",
            "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.s390x",
            "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.x86_64",
            "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.aarch64",
            "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.s390x",
            "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.x86_64",
            "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.aarch64",
            "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.s390x",
            "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.x86_64",
            "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.aarch64",
            "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.s390x",
            "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.aarch64",
            "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.s390x",
            "openSUSE Tumbleweed:python310-oletools-0.60.1-1.1.x86_64",
            "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.aarch64",
            "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.s390x",
            "openSUSE Tumbleweed:python311-oletools-0.60.1-1.1.x86_64",
            "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.aarch64",
            "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.s390x",
            "openSUSE Tumbleweed:python312-oletools-0.60.1-1.1.x86_64",
            "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.aarch64",
            "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.ppc64le",
            "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.s390x",
            "openSUSE Tumbleweed:python39-oletools-0.60.1-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-40444"
    }
  ]
}