November 2019 Patch Tuesday: Actively exploited IE zero-day fixed
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-1373 | A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code… | 9.8 | 21% | ||
| CVE-2019-1429 | Memory corruption RCE in Microsoft Internet Explorer scripting engine | 7.5 | 77% | KEVPoC | KEV |
| CVE-2019-1457 | A security feature bypass vulnerability exists in Microsoft Office software by not enforcing macro settings on an Excel document, aka 'Microsoft Office Excel… | 7.8 | 3% | ||
| CVE-2019-16863 | STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA… | 5.9 | 3% |
From the original article
2 min read at helpnetsecurity.com
November 2019 Patch Tuesday comes with patches for an IE zero-day exploited by attackers in the wild and four Hyper-V escapes. Microsoft has delivered fixes for 74 vulnerabilities in various products, 13 of which are deemed to be critical.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.