December 2019 Patch Tuesday: Microsoft fixes one actively exploited zero-day
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-15361 | The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b… | 5.9 | 10% | ||
| CVE-2019-11157 | Improper conditions check in voltage settings for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege and/or… | 6.7 | <1% | ||
| CVE-2019-1458 | Win32k Object-Handling Flaw Enables Local Privilege Escalation in Microsoft Windows | 7.8 | 74% | KEVRansomwarePoC ×2 | KEV |
CVE-2019-1471+1 related CVE | A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest… | 8.2 group max | 8% | ||
| CVE-2019-1485 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability' | 7.5 | 8% | ||
| CVE-2019-16453 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and… | 9.8 | 6% | ||
| CVE-2019-8255 | Brackets versions 1.14 and earlier have a command injection vulnerability | 9.8 | 7% |
From the original article
5 min read at helpnetsecurity.com
For December 2019 Patch Tuesday, Microsoft and Adobe have released the final scheduled security updates for this year, Intel has fixed Plundervolt, and Google has delivered fixes and new and expanded security features for Chrome. Microsoft’s security releases are for Windows, Internet Explorer, SQL Server, Visual Studio, Hyper-V Server, Office and Office Services and Web App.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.