Product:
Outlook
Summary
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands due to how Microsoft Office handles objects in memory. This vulnerability is known as Microsoft Outlook Security Feature Bypass Vulnerability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2017-11774 |
Exploitation
An attacker can exploit this vulnerability by crafting a malicious email or document that, when opened by a user, triggers the execution of arbitrary commands. The attack requires user interaction, as the user must open the malicious content for the exploit to succeed.
Affected Products
- Outlook 2010 SP2: Vulnerable to arbitrary command execution due to memory handling issues.
- Outlook 2013 SP1: Susceptible to the same security feature bypass vulnerability.
- Outlook 2016: Also affected by the vulnerability allowing command execution.
Mitigation
To mitigate this vulnerability, users should apply updates as per the vendor’s instructions to ensure their software is secure against potential exploits.