Microsoft Patches Exploited Office Bug

An Office memory corruption vulnerability is the only CVE reported as under active attack for this months Patch Tuesday.

Microsoft today released its first wave of Patch Tuesday updates for 2018. This included fixes for a total of 56 CVEs affecting Microsoft Windows, Microsoft Office, Internet Explorer, Microsoft Edge, ChakraCore, ASP.NET, and the .NET Framework. One flaw has been exploited.
Of these 56 vulnerabilities, 16 were ranked Critical, 38 Important, one Moderate and one Low severity. Todays release includes
guidance
for mitigating speculative execution side-channel vulnerabilities following the news of Meltdown and Spectre attacks.
The exploited bug patched today, CVE-2018-0802, is a Critical remote code execution vulnerability in Microsoft Office that exists when software doesnt properly handle objects in memory. An attacker who successfully exploited this could run code in the context of the current user, which would let them install programs, view and edit data, or create new accounts with full user rights. Its more dangerous for victims with administrative rights.
Exploitation would require a user to open a specially crafted file with an affected version of Microsoft Office or WordPad. A threat actor could conduct a phishing attack by sending the file via email and convincing the target to open it. In a web-based attack, the attacker could host a website (or compromise a website) with a file to exploit the Office bug.
No details of the attacks are provided by Microsoft, but the lack of industry discussion likely means this is being used in a targeted attack,
writes
Dustin Childs of Trend Micros Zero Day Initiative Communications. There are multiple Office flaws patched this month, all of which Childs says should also be given a high deployment priority.
In its exploitability assessment, Microsoft reports CVE-2018-0802 has been exploited in the wild. It states that at the time of publication, exploitation is unlikely for both its latest software release and older software release. Affected versions range from Microsoft Office 2007 Service Pack 3 to Microsoft Word 2016, 64-bit edition.
Read more details on CVE-2018-0802, including all affected versions of Office,
here
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Microsoft Patches Exploited Office Bug