CVE-2014-6357 : Use-after-free vulnerability in Microsoft Office 2010 SP2, Office 2013 Gold and

Use-after-free vulnerability in Microsoft Office 2010 SP2, Office 2013 Gold and SP1, Office 2013 RT Gold and SP1, Office for Mac 2011, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 Gold and SP1, and Office Web Apps 2010 SP2 and 2013 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Use After Free Word Remote Code Execution Vulnerability."

Published 2014-12-11 00:59:10

Updated 2018-10-12 22:07:45

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Memory CorruptionExecute code

Products affected by CVE-2014-6357

Microsoft » Office » Version: 2013 Update SP1
cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2013 Gold Edition
cpe:2.3:a:microsoft:office:2013:*:*:*:gold:*:*:*
Matching versions
Microsoft » Office » Version: 2013 Rt Gold Edition
cpe:2.3:a:microsoft:office:2013:*:*:*:rt_gold:*:*:*
Matching versions
Microsoft » Office » Version: 2011 For MAC
cpe:2.3:a:microsoft:office:2011:*:*:*:*:mac:*:*
Matching versions
Microsoft » Office » Version: 2010 Update SP2 For X86
cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:x86:*
Matching versions
Microsoft » Office » Version: 2010 Update SP2 For X64
cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:x64:*
Matching versions
Microsoft » Office » Version: 2013 RT Edition
cpe:2.3:a:microsoft:office:2013:*:*:*:rt:*:*:*
Matching versions
Microsoft » Word Viewer » Version: N/A
cpe:2.3:a:microsoft:word_viewer:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Server » Version: 2010 Update SP2
cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Server » Version: 2013 Update SP1
cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Server » Version: 2013 Gold Edition
cpe:2.3:a:microsoft:sharepoint_server:2013:-:-:*:gold:*:*:*
Matching versions
Microsoft » Office Compatibility Pack » Update SP3
cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Web Applications » Version: 2010 Update SP2
cpe:2.3:a:microsoft:web_applications:2010:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Web Applications » Version: 2013 Update SP1
cpe:2.3:a:microsoft:web_applications:2013:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Web Applications » Version: 2013 Gold Edition
cpe:2.3:a:microsoft:web_applications:2013:*:*:*:gold:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-6357

EPSS FAQ

11.26%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 95 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-6357

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

References for CVE-2014-6357

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-081

Microsoft Security Bulletin MS14-081 - Critical | Microsoft Docs

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2014-6357

Products affected by CVE-2014-6357

Exploit prediction scoring system (EPSS) score for CVE-2014-6357

CVSS scores for CVE-2014-6357

References for CVE-2014-6357