Technical Information

Brief overview of the risk:
This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user.

Detailed Information on the risk:

Exploitation of these vulnerabilities requires that a user open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario an attacker could exploit the vulnerabilities by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerabilities. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or Instant Messenger message.

Further information on this exploit is available at : MS15-070

Microsoft Excel 2007, Microsoft PowerPoint 2007, Microsoft Word 2007
Microsoft Office 2010, Microsoft Excel 2010, Microsoft PowerPoint 2010, Microsoft Word 2010
Microsoft Excel 2013, Microsoft PowerPoint 2013, Microsoft Word 2013
Microsoft Excel 2013 RT, Microsoft PowerPoint 2013 RT, Microsoft Word 2013 RT
Microsoft Excel for Mac 2011
Microsoft Excel Viewer, Microsoft Office Compatibility Pack, Microsoft Word Viewer
Excel Services on Microsoft SharePoint Server 2007
Excel Services on Microsoft SharePoint Server 2010
Excel Services on Microsoft SharePoint Server 2013