high7.8Known exploited
CVE-2017-11774
Microsoft Office Outlook Security Feature Bypass Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2021-11-03. Federal due date: 2022-05-03.
Apply updates per vendor instructions.
Impact
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Outlook | Versions 2010, 2013, 2016 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://www.securityfocus.com/bid/101098
- http://www.securitytracker.com/id/1039542
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774
- https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/
- http://www.securityfocus.com/bid/101098
- http://www.securitytracker.com/id/1039542
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774
- https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11774