Security News

Microsoft has released Office 2011 14.5.4 for Mac OS X version 10.5.8 or later, patching critical vulnerabilities in its software. These updates patch a combined 4 security bugs, including three memory corruption flaws and an integer underflow vulnerability.

The Office for Mac 2011 14.5.4 update applies to the following Microsoft software: Office 2011, Office 2011 Home and Business Edition, Word 2011, Excel 2011, PowerPoint 2011, Outlook 2011, Office for Mac Standard 2011 Edition, Microsoft Office for Mac Home & Student 2011, and Microsoft Office for Mac Academic 2011.

“This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights,” notes Microsoft’s security bulletin (MS15-081).

The vulnerabilities patched in the latest Office for Mac are described as follows:

• CVE-2015-2468 : Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office for Mac 2011, Office for Mac 2016, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, Word Web Apps 2010 SP2, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted document, aka “Microsoft Office Memory Corruption Vulnerability.”
• CVE-2015-2469 : Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, and Office for Mac 2011 allow remote attackers to execute arbitrary code via a crafted document, aka “Microsoft Office Memory Corruption Vulnerability.”
• CVE-2015-2470 : A remote code execution vulnerability exists when Office decreases an integer value beyond its intended minimum value. Exploitation of this vulnerability requires that a user open a specially crafted Office file with an affected version of Microsoft Office software. The security update addresses the vulnerability by correcting how Office handles integer bounds checking.
• CVE-2015-2477 : Microsoft Office 2007 SP3, Office for Mac 2011, Office for Mac 2016, and Word Viewer allow remote attackers to execute arbitrary code via a crafted document, aka “Microsoft Office Memory Corruption Vulnerability.”

Microsoft’s security team addressed these vulnerabilities by:

• Correcting how Office handles files in memory
• Improving, in conjunction with the updates for Internet Explorer and Microsoft Windows, how Microsoft Office programs are executed from Internet Explorer
• Correcting how Office validates Office templates prior to use
• Correcting how Office handles integer bounds checking

We strongly encourage all users running Microsoft Office 2011 for Mac install these updates as soon as possible. Mac users can update your software by using Microsoft’s AutoUpdate application, or you can visit the Microsoft Download Center to get the Office 2011 14.5.4 Update (113.3 MB).