What is CVE-2019-1109?

CVE-2019-1109 is a security advisory published by Microsoft Security Response Center (MSRC) with High severity. Microsoft Office Spoofing Vulnerability

Which CVE IDs does CVE-2019-1109 cover?

CVE-2019-1109 covers the following CVE IDs: CVE-2019-1109. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by CVE-2019-1109?

CVE-2019-1109 affects 9 products, including: Microsoft Office 2013 RT Service Pack 1; Microsoft Office 2013 Service Pack 1 (32-bit editions); Microsoft Office 2013 Service Pack 1 (64-bit editions); Microsoft Office 2016 (32-bit edition); Microsoft Office 2016 (64-bit edition); and others — see the full list on the advisory page.

CVE-2019-1109High

Microsoft Office Spoofing Vulnerability

Vendor

Microsoft Security Response Center (MSRC)

Published

July 9, 2019

Last Modified

—

🔗 CVE IDs covered (1)

CVE-2019-1109 →

📋 Description

A spoofing vulnerability exists when Microsoft Office Javascript does not check the validity of the web page making a request to Office documents. An attacker who successfully exploited this vulnerability could read or write information in Office documents. The security update addresses the vulnerability by correcting the way that Microsoft Office Javascript verifies trusted web pages.

🎯 Affected products9

Microsoft Office 2013 RT Service Pack 1
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2016 (32-bit edition)
Microsoft Office 2016 (64-bit edition)
Microsoft Office 2019 for 32-bit editions
Microsoft Office 2019 for 64-bit editions
Office 365 ProPlus for 32-bit Systems
Office 365 ProPlus for 64-bit Systems

✅ Remediation

KBClick to Run (Security Update) — fixed build https://aka.ms/OfficeSecurityReleases KBClick to Run (Security Update) KB4464534 (Security Update) KB4018375 (Security Update)

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products9

✅ Remediation

🔗 References (5)