SB2020111054 - Multiple vulnerabilities in Microsoft Excel

Security Bulletin ID SB2020111054

Severity

High

Patch available

YES

Number of vulnerabilities 5

Exploitation vector Remote access

Highest impact Code execution

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Code Injection (CVE-ID: CVE-2020-17064)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Microsoft Excel. A remote attacker can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) Code Injection (CVE-ID: CVE-2020-17065)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Microsoft Excel. A remote attacker can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

3) Code Injection (CVE-ID: CVE-2020-17066)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Microsoft Excel. A remote attacker can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

4) Security Features (CVE-ID: CVE-2020-17067)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to security feature bypass issue in Microsoft Excel. A remote attacker can gain unauthorized access to the application.

5) Code Injection (CVE-ID: CVE-2020-17019)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in Microsoft Excel. A remote attacker can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.