CVE-2016-0137: Medium severity microsoft office vulnerability
Published Sep 14, 2016
·Updated
The Click-to-Run (C2R) implementation in Microsoft Office 2013 SP1 and 2016 allows local users to bypass the ASLR protection mechanism via a crafted application, aka "Microsoft APP-V ASLR Bypass."
Affected Software
2 affected components
Microsoft Office=2013-sp1
Microsoft Office=2016
Event History
Sep 14, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-0137?
CVE-2016-0137 is rated as important due to its potential to allow local users to bypass security mechanisms.
2
How do I fix CVE-2016-0137?
To fix CVE-2016-0137, apply the security updates provided by Microsoft for Office 2013 SP1 and 2016.
3
Who is affected by CVE-2016-0137?
CVE-2016-0137 affects local users running Microsoft Office 2013 SP1 and Microsoft Office 2016.
4
What does CVE-2016-0137 allow an attacker to do?
CVE-2016-0137 allows an attacker to bypass the Address Space Layout Randomization (ASLR) protection mechanism.
5
Is CVE-2016-0137 specific to certain versions of Office?
Yes, CVE-2016-0137 specifically affects Microsoft Office versions 2013 SP1 and 2016.