Summary
Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What is SPNEGO Extended Negotiation?
The SPNEGO Extended Negotiation Security Mechanism (NEGOEX) extends Simple and Protected GSS-API Negotiation Mechanism (SPNEGO) described in [RFC4178]. Please see SPNEGO Overview for more information.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability.
Are the updates for the Microsoft Office for Mac currently available?
The security update for Microsoft Office 2019 for Mac and Microsoft Office LTSC for Mac 2021 are not immediately available. The updates will be released as soon as possible, and when they are available, customers will be notified via a revision to this CVE information.
Security updates
10.0.17763.3406 — https://support.microsoft.com/help/5017315
10.0.19043.2006 — https://support.microsoft.com/help/5017308
10.0.20348.1006 — https://support.microsoft.com/help/5017316
10.0.20348.916 — https://support.microsoft.com/help/5017392
10.0.22000.978 — https://support.microsoft.com/help/5017328
10.0.10240.19444 — https://support.microsoft.com/help/5017327
10.0.14393.5356 — https://support.microsoft.com/help/5017305
6.1.7601.26115 — https://support.microsoft.com/help/5017361
6.1.7601.26115 — https://support.microsoft.com/help/5017373
6.3.9600.20571 — https://support.microsoft.com/help/5017367
6.3.9600.20571 — https://support.microsoft.com/help/5017365
6.2.9200.23865 — https://support.microsoft.com/help/5017370
6.2.9200.23865 — https://support.microsoft.com/help/5017377
Vulnerabilities 1
-
High 8.1CVE-2022-37958 EPSS 86%
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
Revision history
-
#3
Updated one or more CVSS scores for the affected products. This is an informational change only.
-
#2
Updated the severity, impact, and CVSS rating from Important Information Disclosure to Critical Remote Code Execution. Added an acknowledgement. These are informational changes only.
-
#1
Information published.
References
-
CVE-2022-37958 SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37958
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss