Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an malicious user to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
microsoft outlook 2010 |
||
microsoft outlook 2016 |
||
microsoft outlook |
||
microsoft outlook 2013 |
Government-backed campaign going after bug that was patched in 2017
An ongoing Iranian government-backed hacking campaign is now trying to exploit a Microsoft Outlook flaw from 2017. The US Cyber Command has issued an alert that hackers have been actively going after CVE-2017-11774. The flaw is a sandbox escape bug in Outlook that allows an attacker who already possesses the victim's Outlook credentials to change the user's home page. That page, in turn, can have embedded code that downloads and executes malware when Outlook is opened. The timing of this alert r...
Vulmon