Vulnerabilitycritical
Microsoft Patch Tuesday — April 2020: Vulnerability disclosures and Snort coverage
- CVEs
- CVE-2020-0939CVE-2020-0687CVE-2020-0907CVE-2020-0929CVE-2020-0931CVE-2020-0932CVE-2020-0938CVE-2020-1020CVE-2020-0968CVE-2020-0970CVE-2020-0969CVE-2020-0910CVE-2020-0927CVE-2020-0948CVE-2020-0949CVE-2020-0950CVE-2020-0965CVE-2020-0967CVE-2020-0974CVE-2020-1022CVE-2020-0760CVE-2020-0784CVE-2020-0956CVE-2020-0957CVE-2020-0958CVE-2020-1004CVE-2020-1005CVE-2020-1027CVE-2020-0699CVE-2020-0794CVE-2020-0821CVE-2020-0835CVE-2020-0888CVE-2020-0889CVE-2020-0895CVE-2020-0899CVE-2020-0900CVE-2020-0906CVE-2020-0913CVE-2020-0917CVE-2020-0918CVE-2020-0919CVE-2020-0920CVE-2020-0923CVE-2020-0924CVE-2020-0925CVE-2020-0926CVE-2020-0930CVE-2020-0933CVE-2020-0934CVE-2020-0935CVE-2020-0936CVE-2020-0937CVE-2020-0940CVE-2020-0942CVE-2020-0943CVE-2020-0944CVE-2020-0945CVE-2020-0946CVE-2020-0947CVE-2020-0952CVE-2020-0953CVE-2020-0954CVE-2020-0955CVE-2020-0959CVE-2020-0960CVE-2020-0961CVE-2020-0962CVE-2020-0964CVE-2020-0966CVE-2020-0971CVE-2020-0972CVE-2020-0973CVE-2020-0975CVE-2020-0976CVE-2020-0977CVE-2020-0978CVE-2020-0979CVE-2020-0980CVE-2020-0981CVE-2020-0982CVE-2020-0983CVE-2020-0984CVE-2020-0985CVE-2020-0987CVE-2020-0988CVE-2020-0991CVE-2020-0992CVE-2020-0993CVE-2020-0994CVE-2020-0995CVE-2020-0996CVE-2020-0999CVE-2020-1000CVE-2020-1001CVE-2020-1002CVE-2020-1003CVE-2020-1006CVE-2020-1007CVE-2020-1008CVE-2020-1009CVE-2020-1011CVE-2020-1014CVE-2020-1015CVE-2020-1016CVE-2020-1017CVE-2020-1018CVE-2020-1019CVE-2020-1026CVE-2020-1029CVE-2020-1049CVE-2020-1050CVE-2020-1094
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-0687 | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Microsoft Graphics Remote… | 8.8 group max | 19% | ||
| CVE-2020-0760 | A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution… | 8.8 | 9% | ||
CVE-2020-0835+1 related CVE | An elevation of privilege vulnerability exists when Windows Defender antimalware platform improperly handles hard links, aka 'Windows Defender Antimalware… | 7.8 group max | <1% | ||
CVE-2020-0968+3 related CVEs | Memory Corruption RCE in Microsoft Internet Explorer Scripting Engine | 7.5 group max | 31% | KEVRansomware | KEV |
| CVE-2020-0899 | An elevation of privilege vulnerability exists when Microsoft Visual Studio updater service improperly handles file permissions, aka 'Microsoft Visual Studio… | 5.5 | <1% | ||
| CVE-2020-0900 | An elevation of privilege vulnerability exists when the Visual Studio Extension Installer Service improperly handles file operations, aka 'Visual Studio… | 5.5 | <1% | ||
CVE-2020-0906+1 related CVE | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel… | 8.8 | 12% | ||
| CVE-2020-0919 | An elevation of privilege vulnerability exists in Remote Desktop App for Mac in the way it allows an attacker to load unsigned binaries, aka 'Microsoft Remote… | 7.8 | <1% | ||
| CVE-2020-0932 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka… | 8.8 group max | 31% | ||
| CVE-2020-0935 | An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links, aka 'OneDrive for Windows… | 5.5 | <1% | ||
CVE-2020-1020+2 related CVEs | Out-of-Bounds Write RCE in Microsoft Windows Adobe Font Manager Library | 8.8 group max | 65% | KEV | KEV |
| CVE-2020-0943 | An authentication bypass vulnerability exists in Microsoft YourPhoneCompanion application for Android, in the way the application processes notifications… | 4.6 | 1% | ||
CVE-2020-0961+2 related CVEs | A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory, aka 'Microsoft Office… | 7.8 | 12% | ||
| CVE-2020-0969 | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Chakra… | 7.5 | 13% | ||
| CVE-2020-0970 | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption… | 7.5 | 13% | ||
| CVE-2020-0984 | An elevation of privilege vulnerability exists when the Microsoft AutoUpdate (MAU) application for Mac improperly validates updates before executing them, aka… | 7.8 | 1% | ||
CVE-2020-1022+1 related CVE | A remote code execution vulnerability exists in Microsoft Dynamics Business Central, aka 'Dynamics Business Central Remote Code Execution Vulnerability' | 8.0 group max | 7% | ||
| CVE-2020-1019 | An elevation of privilege vulnerability exists in RMS Sharing App for Mac in the way it allows an attacker to load unsigned binaries, aka 'Microsoft RMS… | 7.8 | <1% | ||
| CVE-2020-1026 | A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic Curve… | 9.8 | 3% | ||
CVE-2020-1050+1 related CVE | A cross site scripting vulnerability exists when Microsoft Dynamics 365 (on-premises) does not properly sanitize a specially crafted web request to an affected… | 6.1 group max | 2% |
From the original article
5 min read at blog.talosintelligence.com
Microsoft released its monthly security update today, disclosing vulnerabilities across many of its products and releasing corresponding updates. This month's Patch Tuesday covers 115 vulnerabilities. Nineteen of the flaws Microsoft disclosed are considered critical.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.