FKIE_CVE-2015-2379

Vulnerability from fkie_nvd - Published: 2015-07-14 21:59 - Updated: 2025-04-12 10:46
Severity ?
Summary
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
References
secure@microsoft.comhttp://www.securitytracker.com/id/1032899
secure@microsoft.comhttps://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-070
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1032899
af854a3a-2127-422b-91ae-364da2661108https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-070
Impacted products
Vendor Product Version
microsoft office 2010
microsoft office 2010
microsoft office 2011
microsoft word 2007
microsoft word 2013
microsoft word 2013
microsoft word_viewer *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:x64:*",
              "matchCriteriaId": "BB0CF266-A7EE-474A-B3D3-4A7FE33F4C2C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:x86:*",
              "matchCriteriaId": "DC25ACD6-8F48-4534-AF7B-53F0D10C0843",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2011:*:*:*:*:mac:*:*",
              "matchCriteriaId": "AA77823A-1112-49BE-A140-790E8816DAEB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*",
              "matchCriteriaId": "7D006508-BFB0-4F21-A361-3DA644F51D8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "32E1400A-836A-4E48-B2CD-2B0A9A8241BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*",
              "matchCriteriaId": "45E21528-4B0F-4A6F-82AD-DF7FDBF67C8F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:word_viewer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D79B6572-E7DF-4CC2-B70B-9B31BE1B6A81",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka \"Microsoft Office Memory Corruption Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office para Mac 2011, y Word Viewer permiten a atacantes remotos ejecutar c\u00f3digo arbitrario o provocar una denegaci\u00f3n de servicio (corrupci\u00f3n de memoria) a trav\u00e9s de un documento Office manipulado, tambi\u00e9n conocida como \u201cVulnerabilidad de corrupci\u00f3n de Memoria en Microsoft Office.\u201d"
    }
  ],
  "id": "CVE-2015-2379",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.3,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2015-07-14T21:59:13.657",
  "references": [
    {
      "source": "secure@microsoft.com",
      "url": "http://www.securitytracker.com/id/1032899"
    },
    {
      "source": "secure@microsoft.com",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-070"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1032899"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-070"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.