Microsoft Outlook Security Feature Bypass Vulnerability
CVE-2017-11774 is fixed in 7 products on 1 platform, first by KB4011196, released October 10, 2017. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021. Patch Radar priority: Patch now.
<p>A security feature bypass vulnerability exists when Microsoft Outlook improperly handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary commands.</p> <p>In a file-sharing attack scenario, an attacker could provide a specially crafted document file designed to exploit the vulnerability, and then convince users to open the document file and interact with the document.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Outlook handles objects in memory.</p>
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Microsoft | |||
| Microsoft Outlook 2010 Service Pack 2 (32-bit editions) | KB4011196 | Oct 10, 2017 | |
| Microsoft Outlook 2010 Service Pack 2 (64-bit editions) | KB4011196 | Oct 10, 2017 | |
| Microsoft Outlook 2013 RT Service Pack 1 | KB4011178 | Oct 10, 2017 | |
| Microsoft Outlook 2013 Service Pack 1 (32-bit editions) | KB4011178 | Oct 10, 2017 | |
| Microsoft Outlook 2013 Service Pack 1 (64-bit editions) | KB4011178 | Oct 10, 2017 | |
| Microsoft Outlook 2016 (32-bit edition) | KB4011162 | Oct 10, 2017 | |
| Microsoft Outlook 2016 (64-bit edition) | KB4011162 | Oct 10, 2017 | |