Microsoft January 2019 Patch Tuesday updates fix 7 critical vulnerabilities
- CVEs
- CVE-2019-0547CVE-2019-0550CVE-2019-0551CVE-2019-0579CVE-2019-0622CVE-2019-0545CVE-2019-0548CVE-2019-0564CVE-2019-0541CVE-2019-0565CVE-2019-0566CVE-2019-0586CVE-2019-0588CVE-2019-0576CVE-2019-0538CVE-2019-0575CVE-2019-0577CVE-2019-0582CVE-2019-0583CVE-2019-0584CVE-2019-0581CVE-2019-0578CVE-2019-0580CVE-2019-0560CVE-2019-0561CVE-2019-0585CVE-2019-0559CVE-2019-0562CVE-2019-0556CVE-2019-0558CVE-2019-0557CVE-2019-0568CVE-2019-0567CVE-2019-0539CVE-2019-0574CVE-2019-0573CVE-2019-0571CVE-2019-0572CVE-2019-0543CVE-2019-0570CVE-2019-0555CVE-2019-0537CVE-2019-0546CVE-2019-0552CVE-2019-0569CVE-2019-0536CVE-2019-0554CVE-2019-0549CVE-2019-0553
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-0547 | A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka "Windows DHCP… | 9.8 group max | 71% | ||
| CVE-2019-0537 | An information disclosure vulnerability exists when Visual Studio improperly discloses arbitrary file contents if the victim opens a malicious .vscontent file… | 5.5 | 8% | ||
| CVE-2019-0585 | A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka "Microsoft Word Remote Code… | 8.8 group max | 22% | ||
CVE-2019-0539+2 related CVEs | A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting… | 7.5 | 83% | PoC ×3 | |
| CVE-2019-0541 | Remote Code Execution in Microsoft MSHTML Engine (Office and Internet Explorer) | 8.8 | 53% | KEVPoC | KEV |
| CVE-2019-0543 | Local Privilege Escalation (Improper Authentication) in Windows 7/8.1/10 and Server | 7.8 | 5% | KEVRansomwarePoC | KEV |
| CVE-2019-0545 | An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka… | 7.5 | 10% | ||
| CVE-2019-0546 | A remote code execution vulnerability exists in Visual Studio when the C++ compiler improperly handles specific combinations of C++ constructs, aka "Visual… | 7.8 | 16% | ||
CVE-2019-0564+1 related CVE | A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects… | 7.5 | 8% | ||
CVE-2019-0557+2 related CVEs | A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected… | 5.4 | 2% | ||
| CVE-2019-0562 | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected… | 5.4 | 2% | ||
CVE-2019-0566+1 related CVE | An elevation of privilege vulnerability exists in Microsoft Edge Browser Broker COM object, aka "Microsoft Edge Elevation of Privilege Vulnerability." This… | 8.8 group max | 19% | PoC | |
CVE-2019-0586+1 related CVE | A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft… | 9.8 group max | 15% | ||
| CVE-2019-0622 | An elevation of privilege vulnerability exists when Skype for Andriod fails to properly handle specific authentication requests, aka "Skype for Android… | 4.6 | 2% |
From the original article
4 min read at securityaffairs.com
Microsoft has released the January 2019 Patch Tuesday updates that address 51 vulnerabilities in Windows OSs and other products.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.