Information Disclosure in Microsoft OneNote in Microsoft products - CVE-2016-3315

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to out-of-bound read when handling objects in memory. A remote attacker can create a specially crafted OneNote file and convince a victim to open it.

Successful exploitation of this vulnerability my allow an attacker to obtain potentially sensitive information but requires knowledge of the specific location of OneNote objects in memory.

Affected software

How to mitigate CVE-2016-3315

External References

• https://technet.microsoft.com/en-us/library/security/ms16-099.aspx

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office
• Microsoft OneNote Information Disclosure Vulnerability
• Security Update for Microsoft Office