#VU6175 Improper input validation in Microsoft Word and Microsoft Office - CVE-2015-6172

Vulnerability identifier: #VU6175

Vulnerability risk: High

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber

CVE-ID: CVE-2015-6172

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Vulnerable software:
Microsoft Word
Microsoft Office

Software vendor:
Microsoft

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to an error when handling malicious Word files. A remote attacker can create a specially crafted .doc file, trick the victim into opening it and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Install update from vendor's website.

• https://technet.microsoft.com/en-us/library/security/ms15-131.aspx