Jaanus Kp

**Name of the Vulnerable Software and Affected Versions** Microsoft PowerPoint versions (affected versions not specified) Microsoft Office versions (affected versions not specified) Microsoft Office 365 versions (affected versions not specified) **Description** A remote code execution issue exists in Microsoft PowerPoint software due to improper handling of objects in memory. This could allow a remote attacker to execute arbitrary code by using a specially crafted file or web page. If the current user has administrative rights, the attacker could gain control of the system, install programs, view or modify data, or create new accounts with full rights. Users with limited rights may be less affected. The exploitation requires a user to open a specially crafted file with an affected version of Microsoft Office PowerPoint. **Recommendations** For Microsoft PowerPoint, update to a version that properly handles objects in memory to prevent remote code execution. For Microsoft Office, consider disabling the ability to open specially crafted files until a patch is available. For Microsoft Office 365, restrict access to potentially vulnerable components of the software until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Word (affected versions not specified) Office 365 ProPlus (affected versions not specified) Microsoft Office (affected versions not specified) **Description** A remote code execution issue exists due to improper handling of objects in memory. This can be exploited by an attacker using a specially crafted file, allowing them to execute arbitrary code with the privileges of the current user. The exploitation requires a user to open the specially crafted file with an affected version of the software. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 7 SP1 Microsoft Windows 8.1 Microsoft Windows Server 2012 Gold and R2 Microsoft Windows RT 8.1 Microsoft Windows 10 versions 1507 through 1703 Microsoft Windows Server 2016 **Description** The issue is related to the handling of specially crafted embedded fonts by the Microsoft Graphics Component, allowing remote code execution. This can be exploited by remote attackers to execute arbitrary code and affect the system. **Recommendations** For Microsoft Windows Server 2008 SP2 and R2 SP1, update to a newer version to mitigate the risk. For Microsoft Windows 7 SP1, update to a newer version to mitigate the risk. For Microsoft Windows 8.1, update to a newer version to mitigate the risk. For Microsoft Windows Server 2012 Gold and R2, update to a newer version to mitigate the risk. For Microsoft Windows RT 8.1, update to a newer version to mitigate the risk. For Microsoft Windows 10 versions 1507 through 1703, update to a newer version to mitigate the risk. For Microsoft Windows Server 2016, update to a newer version to mitigate the risk.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions 8.1, 10 (Gold, 1511, 1607, 1703), Windows Server 2012 (Gold and R2), Windows Server 2016, Windows RT 8.1 **Description** The issue arises from the Windows Uniscribe component's failure to properly handle objects in memory, leading to a remote code execution vulnerability. This can be exploited by remote attackers to execute arbitrary code on the system. The vulnerability is caused by an out-of-bounds operation in memory, resulting from incorrect handling of objects. **Recommendations** For Microsoft Windows versions 8.1, 10 (Gold, 1511, 1607, 1703), Windows Server 2012 (Gold and R2), Windows Server 2016, and Windows RT 8.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions prior to the fixed version Microsoft Windows 10 Gold and 1511 **Description** The issue exists due to insufficient input validation in the PDF library of the Windows operating system. Exploitation of this issue may allow a remote attacker to execute arbitrary code using a specially crafted PDF document. If successfully exploited, an attacker could cause arbitrary code to execute in the context of the current user. This could lead to an attacker taking control of the affected system, installing programs, viewing, changing, or deleting data, or creating new accounts with full user rights. The impact may be less severe for users with fewer user rights on the system. **Recommendations** For Microsoft Windows 10 Gold and 1511, update to a newer version that contains a fix for this issue. For Microsoft Windows versions prior to the fixed version, update to the fixed version to resolve the issue. As a temporary workaround, consider avoiding the use of specially crafted PDF documents until a patch is available. Restrict access to the PDF library to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Adobe Reader and Acrobat versions prior to 11.0.15 Acrobat and Acrobat Reader DC Classic versions prior to 15.006.30121 Acrobat and Acrobat Reader DC Continuous versions prior to 15.010.20060 **Description** The issue is caused by a buffer overflow, allowing remote attackers to execute arbitrary code or cause a denial of service via memory corruption. This is a result of a memory corruption vulnerability in Adobe Acrobat and Reader. **Recommendations** For Adobe Reader and Acrobat versions prior to 11.0.15, update to version 11.0.15 or later. For Acrobat and Acrobat Reader DC Classic versions prior to 15.006.30121, update to version 15.006.30121 or later. For Acrobat and Acrobat Reader DC Continuous versions prior to 15.010.20060, update to version 15.010.20060 or later.

**Name of the Vulnerable Software and Affected Versions** Apple QuickTime (affected versions not specified) **Description** The issue is related to a heap buffer overflow in the ID3 tag handling of Apple QuickTime, which can lead to remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dyld in Apple iOS versions prior to 9.2 dyld in Apple tvOS versions prior to 9.1 dyld in Apple watchOS versions prior to 2.1 **Description** The issue exists due to insufficient input validation in the dyld component of the iOS operating system. This can be exploited by a remote attacker using a specially crafted app to execute arbitrary code in a privileged context. The problem arises from the mishandling of segment validation. **Recommendations** For iOS versions prior to 9.2, update to version 9.2 or later. For tvOS versions prior to 9.1, update to version 9.1 or later. For watchOS versions prior to 2.1, update to version 2.1 or later.

FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.

**Name of the Vulnerable Software and Affected Versions** Apple Safari (affected versions not specified) **Description** The issue is related to a remote code execution vulnerability due to out-of-bounds access in TTF handling. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.