Vulnerability Details : CVE-2016-7268
Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word for Mac 2011, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted document, aka "Microsoft Office Information Disclosure Vulnerability."
Vulnerability category: Denial of serviceInformation leak
Products affected by CVE-2016-7268
- cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:word_viewer:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:word_for_mac:2011:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-7268
0.92%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 83 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-7268
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:P |
8.6
|
4.9
|
NIST | |
|
7.1
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H |
1.8
|
5.2
|
NIST |
CWE ids for CVE-2016-7268
-
The product reads data past the end, or before the beginning, of the intended buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-7268
-
http://www.securityfocus.com/bid/94672
Microsoft Office CVE-2016-7268 Information Disclosure VulnerabilityThird Party Advisory;VDB Entry
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148
Microsoft Security Bulletin MS16-148 - Critical | Microsoft Docs
-
http://www.securitytracker.com/id/1037441
Microsoft Office Multiple Flaws Let Remote Users Bypass Security, Obtain Potentially Sensitive Information, and Execute Arbitrary Code and Let Local Users Gain Elevated Privileges - SecurityTrackerThird Party Advisory;VDB Entry
Jump to