CVE-2015-2423: excel 2007 · update sp3, 2010 · update sp2, 2013 · update sp1; +15 more affected products

Affected technology

excel · 2007 · update sp3
microsoft

excel · 2010 · update sp2
microsoft

excel · 2013 · update sp1
microsoft

office · 2010 · update sp2
microsoft

powerpoint · 2007 · update sp3
microsoft

powerpoint · 2010 · update sp2
microsoft

powerpoint · 2013 · update sp1
microsoft

visio · 2007 · update sp3
microsoft

visio · 2010 · update sp2
microsoft

visio · 2013 · update sp1
microsoft

visio · 2016
microsoft

word · 2007 · update sp3
microsoft

word · 2010 · update sp2
microsoft

word · 2013 · update sp1
microsoft

word · 2016
microsoft

internet explorer · 7
microsoft

internet explorer · 8
microsoft

internet explorer · 9
microsoft

internet explorer · 10
microsoft

internet explorer · 11
microsoft

windows 10 · Version not applicable in the source CPE
microsoft

windows 7 · Version not applicable in the source CPE
microsoft

windows 8 · Version not applicable in the source CPE
microsoft

windows 8.1 · Version not applicable in the source CPE
microsoft

windows rt · Version not applicable in the source CPE
microsoft

windows rt 8.1 · Version not applicable in the source CPE
microsoft

windows server 2008 · Version not applicable in the source CPE
microsoft

windows server 2008 · r2 · update sp1
microsoft

windows server 2012 · Version not applicable in the source CPE
microsoft

windows server 2012 · r2
microsoft

windows vista · Version not applicable in the source CPE
microsoft

n/a · n/a
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (NVD, CVSS 2.0): Network (remote)

What an attacker can do

Remote attackers can gain privileges and obtain sensitive information via a crafted command-line parameter to an Office application or Notepad, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Unsafe Command Line Parameter Passing Vulnerability.". NVD’s CVSS 2.0 assessment (base score 4.3/10) rates confidentiality impact as partial; integrity and availability impact as none.