CVE-2015-2477CWE-119

CVE-2015-2477

High · published August 15, 2015

CVSS v2.0
9.3
EPSS
14%
Percentile
96.5
In the wild
Unconfirmed
What it is

⚠️ A crafty crafted document can open the door for remote code execution in several Microsoft Office versions! 📄💥 Think of it like a beautifully wrapped gift that actually contains a ticking time bomb. While it looks harmless on the outside, once opened, it can unleash chaos in your system! If exploited, an attacker could execute arbitrary code on the target system, potentially leading to unauthorized access to sensitive information or control over the affected machine. This vulnerability can become a gateway for severe security breaches if not addressed!

Put simply

Think of it like a beautifully wrapped gift that actually contains a ticking time bomb. While it looks harmless on the outside, once opened, it can unleash chaos in your system! This memory corruption vulnerability in Microsoft Office allows an attacker to run arbitrary code by tricking users into opening a specially crafted document, bypassing security mechanisms in place.

What to do

If exploited, an attacker could execute arbitrary code on the target system, potentially leading to unauthorized access to sensitive information or control over the affected machine. This vulnerability can become a gateway for severe security breaches if not addressed! To mitigate this risk, ensure that you apply all available security patches for Office 2007 SP3, Office for Mac 2011, and Office for Mac 2016. Additionally, educate users about the dangers of opening unexpected documents. Regularly review and update your software to the latest versions. You've got this! Tackling this vulnerability will help keep your digital environment secure. 🛡️

The record
Technical detail
CVSS v2.0
9.3 · HIGH
Vector
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS v4.0
Not supplied
EPSS
0.13601 · 96.5th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2015-08-15T04:59Z
Affected products (4)
ProductVersionsFixed in
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/officeall versions—
microsoft/word_viewerall versions—
References (4)
EPSS history
Timeline
  • 15 AUG 00:00Z
    Microsoft Office 2007 SP3, Office for Mac 2011, Office for Mac 2016, and Word Viewer allow remote attackers to execute arbitrary code via a crafted document…
    cvelistv5