Multiple vulnerabilities in Microsoft Products (ESU)

Описание

Multiple vulnerabilities were found in Microsoft Products (Eextended Support Update). Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. A remote code execution vulnerability in Microsoft Graphics can be exploited remotely via specially crafted embedded to execute arbitrary code.
2. A remote code execution vulnerability in GDI+ can be exploited remotely via specially crafted website to execute arbitrary code.
3. A memory corruption vulnerability in Scripting Engine can be exploited remotely via specially crafted website to execute arbitrary code.
4. A remote code execution vulnerability in LNK can be exploited remotely to execute arbitrary code.
5. An elevation of privilege vulnerability in Win32k can be exploited remotely via specially crafted application to gain privileges.
6. An information disclosure vulnerability in Windows GDI can be exploited remotely via specially crafted document to obtain sensitive information.
7. A remote code execution vulnerability in Microsoft COM for Windows can be exploited remotely via specially crafted file to execute arbitrary code.
8. An information disclosure vulnerability in Windows Kernel can be exploited remotely via specially crafted application to obtain sensitive information.
9. An elevation of privilege vulnerability in Windows NDIS can be exploited remotely via specially crafted application to gain privileges.
10. An elevation of privilege vulnerability in Windows Installer can be exploited remotely to gain privileges.

Первичный источник обнаружения

• CVE-2018-8344
  CVE-2018-8397
  CVE-2018-8385
  CVE-2018-8346
  CVE-2018-8404
  CVE-2018-8398
  CVE-2018-8349
  CVE-2018-8348
  CVE-2018-8394
  CVE-2018-8389
  CVE-2018-8396
  CVE-2018-8353
  CVE-2018-8343
  CVE-2018-8342
  CVE-2018-8341
  CVE-2018-8339
  CVE-2018-8373
  CVE-2018-8345
  CVE-2018-8371
  ADV180018
  

Эксплуатация

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Связанные продукты

• Microsoft-Internet-Explorer
• Microsoft-Windows
• Microsoft-Windows-Server
• Microsoft-Windows-Server-2012
• Microsoft-Windows-8
• Microsoft-Windows-7
• Microsoft-Windows-Server-2008
• Windows-RT
• Microsoft-Windows-10
• Microsoft-Edge
• ChakraCore

Список CVE

• CVE-2018-8385
  critical
• CVE-2018-8353
  critical
• CVE-2018-8389
  critical
• CVE-2018-8371
  critical
• CVE-2018-8373
  critical
• CVE-2018-8345
  critical
• CVE-2018-8349
  critical
• CVE-2018-8398
  warning
• CVE-2018-8348
  warning
• CVE-2018-8339
  high
• CVE-2018-8343
  high
• CVE-2018-8394
  warning
• CVE-2018-8346
  critical
• CVE-2018-8404
  high
• CVE-2018-8397
  critical
• CVE-2018-8396
  warning
• CVE-2018-8341
  warning
• CVE-2018-8342
  high
• CVE-2018-8344
  critical

Список KB

• 4343899
• 4343900
• 4343205
• 4344104
• 4340937
• 4341832
• 4343674
• 4340939
• 4338380
• 4457984
• 4458010

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com