Cisco Talospublished Feb 13, 21:26 UTC (Feb 13, 2018)ingested Sep 10, 06:19 UTC

Microsoft Patch Tuesday

Tagscve-2018-0852 cve-2018-0763 cve-2018-0825 cve-2018-0834 cve-2018-0835 vulnerability

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2018-0742 +18 in the same advisory: …0820 …0844 …0846 …0756 …0831 …0828 +12	The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 a The Windows kernel in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way objects are handled in memory, aka "Windows Kernel Elevation of Privilege Vulnerability". This CVE is unique from CVE-2018-0756. CVE-2018-0809, CVE-2018-0820 and CVE-2018-0843. NVD description · AI analysis pending	7.8 group max	1%		microsoft windows 10 microsoft windows 7 microsoft windows 8.1 +1 more	—	Feb 15, 2018
CVE-2018-0755 +4 in the same advisory: …0760 …0761 …0810 …0855	The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the Wi The Microsoft Windows Embedded OpenType (EOT) font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the Windows EOT font engine handles embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0760, CVE-2018-0761, and CVE-2018-0855. NVD description · AI analysis pending	5.5 group max	2%		microsoft windows 7 microsoft windows server 2008	—	Feb 15, 2018
CVE-2018-0860 +3 in the same advisory: …0861 …0839 …0763	Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripti Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0861, and CVE-2018-0866. NVD description · AI analysis pending	7.5 group max	65%	PoC	microsoft edge	—	Feb 15, 2018
CVE-2018-0835 +8 in the same advisory: …0837 …0838 …0834 …0859 …0836 …0856 +2	Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripti Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866. NVD description · AI analysis pending	7.5	65%	PoC	microsoft chakracore microsoft edge	—	Feb 15, 2018
CVE-2018-0840 +2 in the same advisory: …0866 …0847	Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Explorer and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Explorer and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866. NVD description · AI analysis pending	7.5 group max	53%	PoC	microsoft internet explorer microsoft edge	—	Feb 15, 2018
CVE-2018-0841 +4 in the same advisory: …0852 …0851 …0850 …0853	Microsoft Office 2016 Click-to-Run allows a remote code execution vulnerability due to how objects are handled in memory, aka "Office Remote Code Execution Vuln Microsoft Office 2016 Click-to-Run allows a remote code execution vulnerability due to how objects are handled in memory, aka "Office Remote Code Execution Vulnerability" NVD description · AI analysis pending	8.8 group max	20%		microsoft office	—	Feb 15, 2018
CVE-2018-0842	Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Serve Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allow an elevation of privilege vulnerability due to how objects in memory are handled, aka "Windows Kernel Elevation of Privilege Vulnerability". NVD description · AI analysis pending	7.0	1%		microsoft windows embedded compact microsoft windows 10 microsoft windows 7 +1 more	—	Feb 15, 2018
CVE-2018-0848 +3 in the same advisory: …0849 …0862 …0845	Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code ex Equation Editor in Microsoft Office 2003, Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory, aka "Microsoft Word Remote Code Execution Vulnerability". This CVE is unique from CVE-2018-0805, CVE-2018-0806, and CVE-2018-0807. NVD description · AI analysis pending	8.8 group max	20%		microsoft office microsoft office compatibility pack microsoft word	—	Jan 22, 2018
CVE-2018-0864	SharePoint Project Server 2013 and SharePoint Enterprise Server 2016 allow an information disclosure vulnerability due to how web requests are handled, aka "Mic SharePoint Project Server 2013 and SharePoint Enterprise Server 2016 allow an information disclosure vulnerability due to how web requests are handled, aka "Microsoft SharePoint Information Disclosure Vulnerability". NVD description · AI analysis pending	5.4	3%		microsoft sharepoint server	—	Feb 15, 2018
CVE-2018-0869	SharePoint Server 2016 allows an elevation of privilege vulnerability due to how web requests are handled, aka "Microsoft SharePoint Elevation of Privilege Vuln SharePoint Server 2016 allows an elevation of privilege vulnerability due to how web requests are handled, aka "Microsoft SharePoint Elevation of Privilege Vulnerability". NVD description · AI analysis pending	5.4	2%		microsoft sharepoint enterprise server	—	Feb 15, 2018

Full article774 words · extracted from blog.talosintelligence.com · click to collapse

Tuesday, February 13, 2018 16:26

Microsoft Patch Tuesday - February 2018

Today Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 54 new vulnerabilities with 14 of them rated critical, 38 of them rated important, and 2 of them rated Moderate. These vulnerabilities impact Outlook, Edge, Scripting Engine, App Container, Windows, and more.

Critical Vulnerabilities
This month, Microsoft is addressing 14 vulnerabilities that are rated "critical." Talos believes one of these are notable and require prompt attention, detailed below.

CVE-2018-0852 - Microsoft Outlook Memory Corruption Vulnerability

A remote code execution vulnerability has been identified in Microsoft Outlook when the software fails to properly handle objects in memory. An attacker who successfully exploits the vulnerability could run arbitrary code in the context of the current user. Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Outlook software.

Other vulnerabilities deemed Critical are listed below:

Important Vulnerabilities
This month, Microsoft is addressing 38 vulnerabilities that are rated "important." Talos believes one of these vulnerabilities is notable and requires prompt attention. These are detailed below.

CVE-2018-0850 - Microsoft Outlook Elevation of Privilege Vulnerability

A elevation of privilege vulnerability has been identified in Microsoft Outlook that manifest when it initiates processing of incoming messages without sufficient validation of the formatting of the messages. An attacker who successfully exploited the vulnerability could attempt to force Outlook to load a local or remote message store (over SMB). To exploit the vulnerability, the attacker could send a specially crafted email to a victim. Outlook would then attempt to open a pre-configured message store contained in the email upon receipt of the email.

Other vulnerabilities deemed Important are listed below:

Coverage
In response to these vulnerability disclosures, Talos is releasing the following Snort rules that detect attempts to exploit them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Firepower customers should use the latest update to their ruleset by updating their SRU. Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

Snort Rules:

45624-45637
45649-45650
45654-45657
45659-45660
45673-45674
40691-40692

Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/ms-tuesday-63063210e63ef5e7e1ec313f/

Microsoft Patch Tuesday

Vulnerabilities mentionedAll →

Critical Vulnerabilities This month, Microsoft is addressing 14 vulnerabilities that are rated "critical." Talos believes one of these are notable and require prompt attention, detailed below.

Important Vulnerabilities This month, Microsoft is addressing 38 vulnerabilities that are rated "important." Talos believes one of these vulnerabilities is notable and requires prompt attention. These are detailed below.

Critical Vulnerabilities
This month, Microsoft is addressing 14 vulnerabilities that are rated "critical." Talos believes one of these are notable and require prompt attention, detailed below.

Important Vulnerabilities
This month, Microsoft is addressing 38 vulnerabilities that are rated "important." Talos believes one of these vulnerabilities is notable and requires prompt attention. These are detailed below.