Microsoft released out-of-band patch to fix Zero

CVE-2019-0808 is an elevation-of-privilege flaw in the Windows Win32k kernel component, which fails to properly handle objects in memory, allowing a local, low-privileged attacker to execute code in the kernel and take full control of the system (CVSS 3.1: 7.8, high impact on confidentiality, integrity and availability). It is triggered by a local attacker running crafted actions against vulnerable Win32k system calls; a public proof of concept based on the NtUserMNDragOver call path is available. Per the source data, affected products are Windows 7 and Windows Server 2008 (exact service-pack/version ranges are not specified in the data). The bug was one of two Win32k zero-days patched in the March 2019 Patch Tuesday, was being actively exploited in targeted attacks attributed to the FruityArmor and SandCat groups, and Microsoft followed with an out-of-band fix after Google disclosed the zero-day. It is listed in CISA KEV (added 2021-11-03, ransomware use unknown), and EPSS currently assigns roughly a 53% probability of exploitation within 30 days (99th percentile).

Do: Apply the March 2019 Microsoft security updates (or the out-of-band fix) for Windows 7 and Windows Server 2008, including Extended Security Updates for systems past the January 2020 end of support, per the CISA KEV required action. Prioritize shared/terminal and RDS hosts where low-privileged users log in, since successful exploitation grants kernel-level privileges, and review those systems for indicators of the FruityArmor/SandCat targeted intrusions. No reliable workaround is documented for this Win32k flaw, so patching is the primary mitigation.

CVE-2019-1367 is a memory corruption flaw (CWE-787, out-of-bounds write) in the way the Internet Explorer scripting engine handles objects in memory, enabling remote code execution when the corrupted objects are processed. Attackers trigger it by convincing a user to load malicious web content in an affected Internet Explorer installation — such as visiting an attacker-controlled or compromised page, or opening a document/application that hosts IE — with user interaction required per the CVSS vector. Successful exploitation executes attacker code with the user's privileges; the flaw was exploited as an actively-attacked zero-day, with distribution observed through the Magnitude exploit kit, prompting Microsoft to release an out-of-band emergency fix. Any Windows system with an affected Internet Explorer installation is exposed, with enterprise users dependent on IE for legacy web applications at particular risk. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, with known ransomware use), EPSS estimates a 52.4% probability of exploitation within 30 days, and no public proof-of-concept is catalogued.

Do: Apply Microsoft's out-of-band (September 2019) and subsequent cumulative Windows/Internet Explorer security updates on all endpoints, per the vendor's instructions, since this is a KEV-listed flaw with known ransomware use; Microsoft's documented mitigation, restricting access to the IE scripting engine component (jscript.dll) and reducing use of Internet Explorer in favor of a modern browser, can protect systems until patched. Verify the update applied cleanly — users reportedly experienced problems with the initial patches — and prioritize user workstations and any systems used to browse untrusted content.

CVE-2019-5786 is a use-after-free (object lifetime) flaw in Blink, the rendering engine of Google Chrome, fixed in Chrome 72.0.3626.121. A remote attacker triggers it by luring a user to a crafted HTML page, where the stale object allows an out-of-bounds memory access within the renderer process. Successful exploitation produces memory corruption in the browser renderer — scored in the CVSS vector primarily as high availability impact — and Google disclosed the flaw being actively exploited in targeted attacks, reportedly chained with a separate Windows zero-day that Microsoft patched out of band in March 2019. Anyone running Chrome older than 72.0.3626.121 was affected, which at disclosure time meant a large share of Chrome's billion-plus desktop user base. Exploitation is confirmed in the wild: the issue was a zero-day before the patch, it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-23, and EPSS assigns a ~61.5% probability of exploitation within 30 days (99th percentile).

Do: Update Chrome to 72.0.3626.121 or later — verify via the browser's About/Settings help page and relaunch any pending auto-update, since Chrome self-updates but requires a relaunch. Treat as a KEV priority and patch per vendor instructions, and apply Microsoft's March 2019 updates, including the out-of-band Windows fix, because the Chrome flaw was used in combination with a Windows zero-day in the observed targeted attacks.