Memory corruption in Microsoft products - CVE-2015-6122

Vulnerability identifier: #VU6178

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-6122

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error when handling malicious Excel files. A remote attacker can create a specially crafted .xls file, trick the victim into opening it, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Microsoft Excel
Microsoft Office
Microsoft Excel for macOS
Microsoft Office for macOS

Install upfate from vendor's website.

• https://technet.microsoft.com/en-us/library/security/ms15-131.aspx

• Multiple vulnerabilities in Microsoft Office
• Security Update for Microsoft Office to Address Remote Code Execution