Vulnerabilities in MS Office Could Allow Remote Code Execution (3064949)

[kraftwerk]

Microsoft Security Bulletin MS15-059 - Important Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3064949)

Published: June 9, 2015

Version: 1.0

Executive Summary

This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user.

Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

This security update is rated Important for all supported editions of the following software:

• Microsoft Office Compatibility Pack Service Pack 3
• Microsoft Office 2010
• Microsoft Office 2013
• Microsoft Office 2013 RT

https://technet.microsoft.com/library/security/MS15-059

[Ballistic Gelatin]

Hmm...when I applied the following fixes for Office 2013 Pro, I received the following message during the installation routine:

“There are no products affected by these packages installed on this system.”

These are the 3 files I downloaded and attempted to install:

• Security Update for Microsoft Office 2013 (KB3039782) 32-Bit Edition

• Security Update for Microsoft Office 2013 (KB3039749) 32-Bit Edition

• Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB2863812)

Weird.

[kraftwerk]

Weird indeed...

KB2863812 was installed yesterday (via Windows update) in a XP VM when I was making a new Office 2007 portable.

[Ballistic Gelatin]

^^^

Of the 5 "Patch Tuesday" updates that I installed yesterday via Windows Update, none were for Office. Usually, I update my installation of Office once a month via its own internal updater, The June updates for Office 2013 haven't yet appeared in that facility (as of this morning), so I will wait and see.

[212eta]

M$ Office is impressive but it is also full of security holes...

[kraftwerk]

That's why I prefer it portable, with no internet or programming resources.

Even at work I use my own portable.

[Ballistic Gelatin]

New updates for Office 2013 are now available via its internal updater. Latest version is v15.0.4727.1002.

[Any Office application] > FILE > Account > Office Updates > Update Options.

See: https://support.microsoft.com/en-us/kb/3068507