Microsoft Patches Two Dozen RCE Flaws in Office
Microsoft patched about two dozen high-severity Office remote-code-execution flaws, none known exploited.
Microsoft released patches for more than 30 newly disclosed vulnerabilities, most of them in Office. About two dozen are high-severity remote code execution flaws, including roughly six reachable through the Preview Pane, generally via a crafted document that a user opens. Word received most fixes, with smaller sets for Excel, Outlook, PowerPoint, and SharePoint, plus information-disclosure and a security-bypass issue. Microsoft also fixed defects in ASP.NET Core, Identity Web, and MSAL for Node.js, and said none were exploited as zero-days. Updates were additionally noted for Office LTSC for Mac 2021 and 2024 and Microsoft 365 for Mac.
- More than 30 new Microsoft vulnerabilities were patched.
- About two dozen high-severity Office flaws allow remote code execution.
- Roughly six bugs can be reached through the Preview Pane.
- Microsoft says none were exploited in the wild.
- Mac Office updates were added to earlier October advisories.
Full article260 words · extracted from securityweek.com · click to collapse
Hot on the heels of its record Patch Tuesday rollout, Microsoft on Thursday announced patches for over 30 new vulnerabilities.
Most of the new fixes address security defects in the Office suite. Two dozen of them patch high-severity remote code execution (RCE) flaws, including half a dozen bugs that could be targeted via the Preview Pane.
In most cases, exploitation requires an attacker to send a specially crafted file, such as a malicious document, and convince the recipient to open it.
Buffer overflow issues are blamed for most of the RCEs, with several defects being off-by-one, use-after-free, path traversal, and numeric truncation errors.
Word received the majority of patches, with only a few rolled out for Excel, Outlook, PowerPoint, and SharePoint.
In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in the Office suite.
Advertisement. Scroll to continue reading.
Additionally, it resolved a denial-of-service (DoS) defect in ASP.NET Core, an elevation of privilege in Identity Web, and an information disclosure in Authentication Library (MSAL) for Node.js.
According to Microsoft, none of the newly resolved issues have been exploited in the wild as a zero-day.
On Thursday, Microsoft also updated dozens of advisories initially published on October 13 to notify customers that security updates have been released for Office LTSC for Mac 2021 and 2024, and for Office 365 for Mac.
Related: Palo Alto Networks Patches PAN-OS Zero-Day Exploited for Remote Code Execution
Related: Cisco Warns of Exploited Secure Email Gateway Vulnerability
Related: Chrome, Firefox Updates Patch 114 Flaws as Mozilla Unveils Firefox Enterprise
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.securityweek.com/microsoft-patches-two-dozen-rce-flaws-in-office/