July 2019 Patch Tuesday: Microsoft plugs two actively exploited zero-days
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-15664 | In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving… | 7.5 | 3% | PoC ×2 | |
| CVE-2019-0865 | A denial of service vulnerability exists when SymCrypt improperly handles a specially crafted digital signature.An attacker could exploit the vulnerability by… | 7.5 | 5% | ||
| CVE-2019-0880 | Local Privilege Escalation in Microsoft Windows splwow64.exe (CVE-2019-0880) | 7.8 | 2% | KEV | KEV |
| CVE-2019-0887 | A remote code execution vulnerability exists in Remote Desktop Services - formerly known as Terminal Services - when an authenticated attacker abuses clipboard… | 8.0 | 71% | ||
| CVE-2019-1068 | Remote Code Execution in Microsoft SQL Server 2016 and 2017 | 8.8 | 57% | KEV | KEV |
| CVE-2019-1072 | A remote code execution vulnerability exists when Azure DevOps Server and Team Foundation Server (TFS) improperly handle user input, aka 'Azure DevOps Server… | 9.8 | 12% | ||
| CVE-2019-1132 | Local Privilege Escalation in Microsoft Win32k on Windows 7 and Server 2008 | 7.8 | 10% | KEV | KEV |
From the original article
3 min read at helpnetsecurity.com
For July 2019 Patch Tuesday, Microsoft has pushed out patches for 78 CVE-numbered vulnerabilities (15 of them critical) and Adobe for three, but none of them in its most widely used software. It’s unusual to see no patches for Flash or Acrobat/Reader, but I suppose it had to happen sometimes. Instead, Adobe released patches for flaws in: Dreamweaver (a privilege escalation flaw in the software’s installer)
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.