=====================================================================

                           CERT-Renater

               Note d'Information No. 2014/VULN296
_____________________________________________________________________

DATE                : 10/12/2014

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Microsoft Excel versions
                                       2007, 2010, 2013.

======================================================================
KB3017347
https://technet.microsoft.com/library/security/ms14-083
______________________________________________________________________

Microsoft Security Bulletin MS14-083 - Important Vulnerabilities in
Microsoft Excel Could Allow Remote Code Execution (3017347)

Published: December 9, 2014

Version: 1.0


Executive Summary

This security update resolves two privately reported vulnerabilities in
Microsoft Excel. The vulnerabilities could allow remote code execution
if an attacker convinces a user to open or preview a specially crafted
Microsoft Excel file in an affected version of Microsoft Office
software. An attacker who successfully exploited the vulnerabilities
could gain the same user rights as the current user. If the current
user is logged on with administrative user rights, an attacker could
then install programs; view, change, or delete data;
or create new accounts with full user rights. Customers whose accounts
are configured to have fewer user rights on the system could be less
impacted than users who operate with administrative user rights.


Affected Software

Microsoft Excel 2007
Microsoft Excel 2010
Microsoft Excel 2013 and Microsoft Excel 2013 RT


Vulnerability Information

Global Free Remote Code Execution in Excel Vulnerability - CVE-2014-6360

A remote code execution vulnerability exists in the way that Microsoft
Excel does not properly handle objects in memory while parsing
specially crafted Office files. System memory may be corrupted in such
a way that an attacker could execute arbitrary code. Microsoft received
information about this vulnerability through coordinated vulnerability
disclosure.

Excel Invalid Pointer Remote Code Execution Vulnerability - CVE-2014-6361

A remote code execution vulnerability exists in the way that Microsoft
Excel does not properly handle objects in memory while parsing
specially crafted Office files. System memory may be corrupted in such
a way that an attacker could execute arbitrary code.

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================