Microsoft Office – OLE Packager allows code execution in all Office versions

Re:Microsoft Office – OLE Packager allows code execution in ... by stephengillie on Thursday July 02, 2015 @06:00PM (#9822003)

The basic idea was great - copy some cells out of Excel and paste them into Word. You can put your sales statistics into your end-of-quarter report.

Then they added linking, so when the spreadsheet was updated, your report would update too. So you could make the report early, let Accounting update the spreadsheet, then just let the report auto-update.

I'm pretty sure Outlook uses the Word rendering engine. And dragging documents into Outlook is one of the ways to attach/embed a file into the email. So I'm pretty sure this still leverages that code.

I'm actually guessing this is almost everywhere. Maybe it didn't get put into Vista (where a number of security enhancements like the 2-level model aka UAC elevation got made) but it's still all over Office. I wonder if IE is impacted.

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by julian_t on Friday July 03, 2015 @04:52AM (#9824368)

> Then they added linking

And that's great, until someone inserts a couple of rows into the range you've linked. Or moves the file. Or any one of another hundred things could happen to upset the OLE Gods.

Do not go anywhere near OLE linking... that way lies madness.

[ Parent | on HN ]

Re:Microsoft Office – OLE Packager allows code execution in ... by so0k on Thursday July 02, 2015 @07:16PM (#9822380)

or link to the latest covers to make sure they are always up to date. no longer need to worry about those memos, wouldn't that be great?

[ Parent | on HN ]