CVE:CVE-2012-1854
CNNVD:CNNVD-201207-092
Microsoft Office是美国微软（Microsoft）公司开发的一款办公软件套件产品。常用组件有Word、Excel、Access、Powerpoint、FrontPage等。
Microsoft Office 2003 SP3、2007 SP2和SP3、2010 Gold和SP1；Microsoft Visual Basic for Applications (VBA)；Summit Microsoft Visual Basic for Applications SDK中的VBE6.dll中存在不可信搜索路径漏洞。本地攻击者可利用该漏洞通过在当前包含a .docx文件的工作目录中Trojan木马DLL获取特权。又名‘Visual Basic for Applications不安全库加载漏洞’。
solution:Upgrade microsoft office to a higher version than 2003:sp3,2007:sp2,2007:sp3,2010,2010:sp1,and avoid the version 2003:sp3,2007:sp2,2007:sp3,2010,2010:sp1; Upgrade microsoft visual_basic_for_applications to a higher version than *; Upgrade microsoft visual_basic_for_applications_sdk to a higher version than *