Vulnerabilitycritical
Microsoft Patch Tuesday — Dec. 2019: Vulnerability disclosures and Snort coverage
- CVEs
- CVE-2019-1468CVE-2019-1471CVE-2019-1458CVE-2019-1469CVE-2019-1485CVE-2019-1332CVE-2019-1400CVE-2019-1453CVE-2019-1461CVE-2019-1462CVE-2019-1463CVE-2019-1464CVE-2019-1465CVE-2019-1466CVE-2019-1467CVE-2019-1470CVE-2019-1472CVE-2019-1474CVE-2019-1476CVE-2019-1477CVE-2019-1478CVE-2019-1480CVE-2019-1481CVE-2019-1483CVE-2019-1484
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-1332 | A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web… | 6.1 | 11% | PoC | |
CVE-2019-1462+3 related CVEs | A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka 'Microsoft… | 7.8 group max | 18% | ||
| CVE-2019-1468 | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote… | 8.8 group max | 17% | ||
| CVE-2019-1458 | Win32k Object-Handling Flaw Enables Local Privilege Escalation in Microsoft Windows | 7.8 | 74% | KEVRansomwarePoC ×2 | KEV |
| CVE-2019-1464 | An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information… | 5.5 | 8% | ||
CVE-2019-1478+2 related CVEs | An elevation of privilege vulnerability exists when Windows improperly handles COM object creation, aka 'Windows COM Server Elevation of Privilege… | 7.8 group max | <1% | ||
| CVE-2019-1485 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability' | 7.5 | 8% |
From the original article
2 min read at blog.talosintelligence.com
Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates. This month's Patch Tuesday covers 25 vulnerabilities, two of which are considered critical.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.