CVE-2015-0085

CVE-2015-0085

High Β· published March 11, 2015

CVSS v2.0
9.3
EPSS
19%
Percentile
97.3
In the wild
Unconfirmed
What it is

🚨 A sneaky use-after-free vulnerability lurks in various Microsoft Office versions, ready to let attackers execute arbitrary code with just one crafty document! 😱 Think of this flaw like an unfixed pothole in a busy street β€” drivers might get caught off guard, causing accidents that could've been avoided with proper maintenance. In this case, an unsuspecting user opens a document, and bam! The pothole is hit, leading to chaos. An attacker could deliver a malicious Office document that, when opened, triggers this vulnerability. This means they could potentially take control of the user's system, conduct unauthorized actions, or steal sensitive data β€” a nightmarish scenario for anyone!

Put simply

Think of this flaw like an unfixed pothole in a busy street β€” drivers might get caught off guard, causing accidents that could've been avoided with proper maintenance. In this case, an unsuspecting user opens a document, and bam! The pothole is hit, leading to chaos. This use-after-free vulnerability allows remote attackers to execute arbitrary code by exploiting how Microsoft Office handles memory in certain situations. When an object in memory is accessed after it has been freed, unintended code execution can occur.

What to do

An attacker could deliver a malicious Office document that, when opened, triggers this vulnerability. This means they could potentially take control of the user's system, conduct unauthorized actions, or steal sensitive data β€” a nightmarish scenario for anyone! To protect yourself, patch your Microsoft Office installations to the latest versions immediately. If you're using any of the affected versions, ensure you apply any available updates and check for additional security measures to mitigate exploitation. Stay vigilant! You've got this! Stay proactive and secure your Office environment, and you'll be the hero of your own digital story! πŸ¦Έβ€β™‚οΈ

The record
Technical detail
CVSS v2.0
9.3 Β· HIGH
Vector
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS v4.0
Not supplied
EPSS
0.18745 Β· 97.3th percentile
Published
2015-03-11T14:59Z
Affected products (29)
ProductVersionsFixed in
microsoft/excelall versionsβ€”
microsoft/excelall versionsβ€”
microsoft/excelall versionsβ€”
microsoft/excel_viewerall versionsβ€”
microsoft/officeall versionsβ€”
microsoft/officeall versionsβ€”
microsoft/officeall versionsβ€”
microsoft/officeall versionsβ€”
microsoft/officeall versionsβ€”
microsoft/office_compatibility_packall versionsβ€”
microsoft/office_web_apps_serverall versionsβ€”
microsoft/office_web_apps_serverall versionsβ€”
microsoft/office_web_apps_serverall versionsβ€”
microsoft/powerpointall versionsβ€”
microsoft/powerpointall versionsβ€”
microsoft/sharepoint_foundationall versionsβ€”
microsoft/sharepoint_foundationall versionsβ€”
microsoft/sharepoint_foundationall versionsβ€”
microsoft/sharepoint_serverall versionsβ€”
microsoft/sharepoint_serverall versionsβ€”
microsoft/sharepoint_serverall versionsβ€”
microsoft/sharepoint_serverall versionsβ€”
microsoft/sharepoint_servicesall versionsβ€”
microsoft/web_applicationsall versionsβ€”
microsoft/wordall versionsβ€”
microsoft/wordall versionsβ€”
microsoft/wordall versionsβ€”
microsoft/wordall versionsβ€”
microsoft/wordall versionsβ€”
References (4)
EPSS history
Timeline
  • 11 MAR 10:00Z
    Use-after-free vulnerability in Microsoft Office 2007 SP3, Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010…
    cvelistv5