Vulnerabilitycritical
Microsoft Patch Tuesday
- CVEs
- CVE-2018-4944CVE-2018-8174CVE-2018-0959CVE-2018-0961CVE-2018-8115CVE-2018-8178CVE-2018-0946CVE-2018-0951CVE-2018-0953CVE-2018-0954CVE-2018-0955CVE-2018-8114CVE-2018-8122CVE-2018-8137CVE-2018-0945CVE-2018-1022CVE-2018-8139CVE-2018-8128CVE-2018-8133CVE-2018-0943CVE-2018-8130CVE-2018-8177CVE-2018-8120CVE-2018-8123CVE-2018-8124CVE-2018-8147CVE-2018-8148CVE-2018-8157CVE-2018-8158CVE-2018-8161CVE-2018-8162CVE-2018-8164CVE-2018-8165CVE-2018-8166CVE-2018-8167CVE-2018-8179CVE-2018-0765CVE-2018-0824CVE-2018-0854CVE-2018-0958CVE-2018-1021CVE-2018-1025CVE-2018-1039CVE-2018-8112CVE-2018-8119CVE-2018-8126CVE-2018-8127CVE-2018-8129CVE-2018-8132CVE-2018-8134CVE-2018-8141CVE-2018-8145CVE-2018-8149CVE-2018-8150CVE-2018-8151CVE-2018-8152CVE-2018-8155CVE-2018-8156CVE-2018-8159CVE-2018-8160CVE-2018-8163CVE-2018-8170CVE-2018-8173CVE-2018-8897
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-0765 | A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka ".NET and .NET Core Denial of Service Vulnerability."… | 7.5 | 8% | ||
CVE-2018-0824+1 related CVE | Deserialization of Untrusted Data RCE in Microsoft COM for Windows | 8.8 group max | 73% | KEVPoC | KEV |
| CVE-2018-8164 | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of… | 7.8 group max | 2% | ||
| CVE-2018-0953 | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory… | 7.5 group max | 67% | PoC | |
CVE-2018-8126+3 related CVEs | A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies, aka "Internet Explorer… | 8.8 group max | 6% | ||
| CVE-2018-1039 | A security feature bypass vulnerability exists in .Net Framework which could allow an attacker to bypass Device Guard, aka ".NET Framework Device Guard… | 7.8 | 1% | ||
| CVE-2018-4944 | Adobe Flash Player versions 29.0.0.140 and earlier have an exploitable type confusion vulnerability | 9.8 | 9% | ||
| CVE-2018-8115 | A remote code execution vulnerability exists when the Windows Host Compute Service Shim (hcsshim) library fails to properly validate input while importing a… | 8.6 | 35% | ||
| CVE-2018-8119 | A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka… | 5.6 | 1% | ||
| CVE-2018-8120 | Local Privilege Escalation in Microsoft Win32k (Windows 7 / Server 2008) | 7.0 | 73% | KEVRansomwarePoC | KEV |
| CVE-2018-8145 | An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to… | 7.5 | 67% | PoC | |
CVE-2018-8147+3 related CVEs | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel… | 7.8 group max | 25% | ||
CVE-2018-8149+2 related CVEs | An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected… | 5.4 | 3% | ||
CVE-2018-8157+4 related CVEs | A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office… | 7.8 group max | 25% | ||
CVE-2018-8152+2 related CVEs | An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange… | 5.4 group max | 4% | ||
| CVE-2018-8173 | A remote code execution vulnerability exists in Microsoft InfoPath when the software fails to properly handle objects in memory, aka "Microsoft InfoPath Remote… | 7.8 | 20% | ||
| CVE-2018-8897 | A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some… | 7.8 | 19% | PoC |
From the original article
3 min read at blog.talosintelligence.com
Today, Microsoft has released its monthly set of security advisories for vulnerabilities that have been identified and addressed in various products. This month's advisory release addresses 67 new vulnerabilities, with 21 of them rated critical, 42 of them rated important, and four rated as low severity. These vulnerabilities impact Outlook, Office, Exchange, Edge, Internet Explorer and more.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.