此安全更新可解决 Microsoft Office 中 3 个秘密报告的漏洞。如果特制文件在 Microsoft Word 的受影响版本或其他受影响的 Microsoft Office 软件中打开，则这些漏洞可能允许远程执行代码。成功利用该漏洞的攻击者可以获得与当前用户相同的用户权限。那些帐户被配置为拥有较少系统用户权限的用户比具有管理用户权限的用户受到的影响要小。
对于 Microsoft Word 2003、Microsoft Word 2007、Microsoft Word 2010、Microsoft Word 2013、Microsoft Word 2013 RT 的所有支持版本，以及 Microsoft SharePoint Server 2010、Microsoft SharePoint Server 2013 和 Microsoft Web Apps Server 2013 的受支持版本上受影响的 Microsoft Office 服务和 Web Apps，此安全更新的等级为“重要”。对于 Microsoft Word Viewer 和 Microsoft Office 兼容包的受支持版本，此安全更新的等级也为“重要”。该安全更新通过更正 Microsoft Office 分析特制文件的方式来解决漏洞。
More
This security update resolves one publicly disclosed vulnerability in a Microsoft Office shared component that is currently being exploited. The vulnerability could allow security feature bypass if a user views a specially crafted webpage in a web browser capable of instantiating COM components, such as Internet Explorer. In a web-browsing attack scenario, an attacker who successfully exploited this vulnerability could bypass the Address Space Layout Randomization (ASLR) security feature, which helps protect users from a broad class of vulnerabilities. The security feature bypass by itself does not allow arbitrary code execution. However, an attacker could use this ASLR bypass vulnerability in conjunction with another vulnerability, such as a remote code execution vulnerability that could take advantage of the ASLR bypass to run arbitrary code.
此安全更新解决 Microsoft Exchange Server 中三个公开披露的漏洞和一个秘密报告的漏洞。Microsoft Exchange Server 的 WebReady Document Viewing 和数据丢失防护功能中存在最严重的漏洞。如果攻击者向受影响的 Exchange Server 中的用户发送包含特制文件的电子邮件，则这些漏洞可能允许在 LocalService 帐户的安全上下文中远程执行代码。LocalService 帐户在本地系统上具有最低特权，在网络上提供匿名凭据。
此安全更新可解决 Microsoft Office 中一个秘密报告的漏洞，如果用户尝试打开恶意网站上托管的 Office 文件，则该漏洞可能允许信息泄露。成功利用此漏洞的攻击者可以确定用于在目标 SharePoint 或其他 Microsoft Office Server 站点上对当前用户进行身份验证的访问令牌。