Information disclosure in Microsoft Office for macOS and Microsoft Outlook for macOS - CVE-2017-0207

Vulnerability details

The vulnerability exists due to improper HTML tag input validation when parsing malicious files in Microsoft Outlook for Mac. A remote unauthenticated attacker can create a specially crafted email with specific HTML tags, trick the victim into opening it, perform spoofing attack and access authentication information or login credentials.

Successful exploitation of the vulnerability results in information disclosure.

Affected software

How to mitigate CVE-2017-0207

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0207

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Office
• Microsoft Office Spoofing Vulnerability