<p>An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data.</p> <p>To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker must know the memory address location where the object was created.</p> <p>The update addresses the vulnerability by changing the way certain Excel functions handle objects in memory.</p>
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Microsoft Office | — | Upgrade to the latest version of Microsoft Office | Sep 15, 2020 | Sep 8, 2020 |
| Msft | — | Security Update for Microsoft SharePoint Enterprise Server 2013 (KB4484516)Security Update for Microsoft Office Online Server (KB4484503) farm-deploymentSecurity Update for Microsoft Excel 2010 (KB4486665) 32-Bit EditionSecurity Update for Microsoft Office Web Apps Server 2013 (KB4484518)Security Update for Microsoft Excel 2010 (KB4486665) 64-Bit EditionSecurity Update for Microsoft Excel 2013 (KB4484526) 32-Bit EditionSecurity Update for Microsoft Excel 2013 (KB4484526) 64-Bit Edition | Sep 8, 2020 | Sep 8, 2020 |
| Office For Mac | — | Upgrade to Office for Mac version 16.16.26Upgrade to Office for Mac version 16.41.0 | Sep 8, 2020 | Sep 8, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub