Multiple vulnerabilities in Microsoft Products (ESU)

Description

Multiple vulnerabilities were found in Microsoft Products (Eextended Support Update). Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in Microsoft Graphics can be exploited remotely via specially crafted embedded to execute arbitrary code.
2. A remote code execution vulnerability in GDI+ can be exploited remotely via specially crafted website to execute arbitrary code.
3. A memory corruption vulnerability in Scripting Engine can be exploited remotely via specially crafted website to execute arbitrary code.
4. A remote code execution vulnerability in LNK can be exploited remotely to execute arbitrary code.
5. An elevation of privilege vulnerability in Win32k can be exploited remotely via specially crafted application to gain privileges.
6. An information disclosure vulnerability in Windows GDI can be exploited remotely via specially crafted document to obtain sensitive information.
7. A remote code execution vulnerability in Microsoft COM for Windows can be exploited remotely via specially crafted file to execute arbitrary code.
8. An information disclosure vulnerability in Windows Kernel can be exploited remotely via specially crafted application to obtain sensitive information.
9. An elevation of privilege vulnerability in Windows NDIS can be exploited remotely via specially crafted application to gain privileges.
10. An elevation of privilege vulnerability in Windows Installer can be exploited remotely to gain privileges.

Fiches de renseignement originales

• CVE-2018-8344

• CVE-2018-8397
• CVE-2018-8385
• CVE-2018-8346
• CVE-2018-8404
• CVE-2018-8398
• CVE-2018-8349
• CVE-2018-8348
• CVE-2018-8394
• CVE-2018-8389
• CVE-2018-8396
• CVE-2018-8353
• CVE-2018-8343
• CVE-2018-8342
• CVE-2018-8341
• CVE-2018-8339
• CVE-2018-8373
• CVE-2018-8345
• CVE-2018-8371
• ADV180018

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Produits associés

• Microsoft-Internet-Explorer
• Microsoft-Windows
• Microsoft-Windows-Server
• Microsoft-Windows-Server-2012
• Microsoft-Windows-8
• Microsoft-Windows-7
• Microsoft-Windows-Server-2008
• Windows-RT
• Microsoft-Windows-10
• Microsoft-Edge
• ChakraCore

Liste CVE

• CVE-2018-8385
  critical
• CVE-2018-8353
  critical
• CVE-2018-8389
  critical
• CVE-2018-8371
  critical
• CVE-2018-8373
  critical
• CVE-2018-8345
  critical
• CVE-2018-8349
  critical
• CVE-2018-8398
  high
• CVE-2018-8348
  warning
• CVE-2018-8339
  high
• CVE-2018-8343
  critical
• CVE-2018-8394
  high
• CVE-2018-8346
  critical
• CVE-2018-8404
  high
• CVE-2018-8397
  critical
• CVE-2018-8396
  warning
• CVE-2018-8341
  warning
• CVE-2018-8342
  critical
• CVE-2018-8344
  critical

Liste KB

• 4343899
• 4343900
• 4343205
• 4344104
• 4340937
• 4341832
• 4343674
• 4340939
• 4338380
• 4457984
• 4458010

En savoir plus

Découvrez les statistiques de la propagation des vulnérabilités dans votre région statistics.securelist.com