CyberSec.Space Logo
CVEブラウザに戻る

CVE-2015-1641

Known Exploited (CISA KEV)HIGH
7.8
CVSS Severity Score
EPSS Score47.1550%
EPSS Percentile90.12th
Published2015年4月14日
Last Modified2026年4月22日

Vulnerability Description

Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."

Affected Platforms (CPE)

📦
Microsoft

Office

= 2010
📦
Microsoft

Office Compatibility Pack

All versions
📦
Microsoft

Office Web Apps

= 2010
📦
Microsoft

Office Web Apps

= 2013
📦
Microsoft

Outlook

= 2011
📦
Microsoft

Sharepoint Server

= 2010
📦
Microsoft

Sharepoint Server

= 2013
📦
Microsoft

Word

= 2007
📦
Microsoft

Word

= 2010
📦
Microsoft

Word

= 2011
📦
Microsoft

Word

= 2013
📦
Microsoft

Word

= 2013

References & Advisories

🔗 http://www.securityfocus.com/bid/73995
🔗 http://www.securitytracker.com/id/1032104
🔗 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-033
🔗 http://www.securityfocus.com/bid/73995
🔗 http://www.securitytracker.com/id/1032104
🔗 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-033
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1641

関連する脆弱性情報

CVE-2001-122310.0

The web administration server for ELSA Lancom 1100 Office does not require authentication, which allows arbitrary remote attackers...

CVE-2001-126010.0

Avaya Argent Office uses weak encryption (trivial encoding) for passwords, which allows remote attackers to gain administrator pri...

CVE-2000-085410.0

When a Microsoft Office 2000 document is launched, the directory of that document is first used to locate DLL's such as riched20.d...

CVE-2007-111710.0

Unspecified vulnerability in Publisher 2007 in Microsoft Office 2007 allows remote attackers to execute arbitrary code via unspeci...