Microsoft has released Office for Mac 2011 14.4.5 Update with security fixes for a Microsoft Word File Format vulnerability. This update patches one vulnerability (CVE-2014-4117) in Microsoft Office that could allow remote code execution if a specifically crafted file is opened in an affected version of Office.
The Microsoft Office for Mac 2011 14.4.5 Update applies to the following software: Office 2011, Office 2011 Home and Business Edition, Word 2011, Excel 2011, PowerPoint 2011, Outlook 2011, Office for Mac Standard 2011 Edition, Microsoft Office for Mac Home & Student 2011, and Microsoft Office for Mac Academic 2011.
Office for Mac 2011 14.4.5 patches a Microsoft Word File Format vulnerability:
CVE-2014-4117 : Microsoft Office 2007 SP3, Word 2007 SP3, Office 2010 SP1 and SP2, Word 2010 SP1 and SP2, Office for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP1 and SP2, and Word Web Apps 2010 Gold, SP1, and SP2 allow remote attackers to execute arbitrary code via crafted properties in a Word document, aka “Microsoft Word File Format Vulnerability.”
Microsoft’s security bulletin (MS14-061) describes the threat as follows:
A remote code execution vulnerability exists in way that Microsoft Office software parses certain properties of Microsoft Word files. If an attacker is successful in exploiting this vulnerability, and if the current user is logged on with administrative user rights, the attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Microsoft addressed the vulnerability by correcting the way that Microsoft Office parses specially crafted files.
We strongly encourage all users running Microsoft Office 2011 for Mac apply these updates as soon as possible. Office for Mac 2011 users can update your software using Microsoft’s AutoUpdate application, or you can visit Microsoft Download Center to get the Microsoft Office for Mac 2011 14.4.5 Update (113.6 MB).
