(MS13-084) Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution (2885089)
Severity: HIGH
CVE Identifier: CVE-2013-3889,CVE-2013-3895
Advisory Date: OCT 09, 2013
DESCRIPTION
This security update resolves two privately reported vulnerabilities in Microsoft Office server software. The most severe vulnerability could allow remote code execution if a user opens a maliciously-crafted Office file in an affected version of Microsoft SharePoint Server, Microsoft Office Services, or Web Apps.
SOLUTION
AFFECTED SOFTWARE AND VERSION
- Microsoft SharePoint Foundation 2010 Service Pack 1 (wssloc)
- Microsoft SharePoint Foundation 2010 Service Pack 2 (wssloc)
- Microsoft SharePoint Server 2013 (wacserver)
- Microsoft SharePoint Server 2013 (pptserver)
- Microsoft Web Applications 2010 Service Pack 1
- Microsoft Web Applications 2010 Service Pack 2
- Microsoft Windows SharePoint Services 3.0 Service Pack 3 (wssloc) (32-bit versions)
- Microsoft Windows SharePoint Services 3.0 Service Pack 3 (wssloc) (64-bit versions)
- Excel Services
- Word Automation Services
- Microsoft Excel Web App 2010 Service Pack 1
- Microsoft Excel Web App 2010 Service Pack 2