Kaspersky ID:
KLA11863
Дата обнаружения:
14/07/2020
Обновлено:
22/01/2024

Описание

Multiple vulnerabilities were found in Microsoft Products (Extended Support Update). Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, execute arbitrary code, cause denial of service.

Below is a complete list of vulnerabilities:

  1. An elevation of privilege vulnerability in Group Policy Services Policy Processing can be exploited remotely via specially crafted application to gain privileges.
  2. An elevation of privilege vulnerability in Windows CNG Key Isolation Service can be exploited remotely via specially crafted application to gain privileges.
  3. An elevation of privilege vulnerability in Windows Modules Installer can be exploited remotely via specially crafted application to gain privileges.
  4. An information disclosure vulnerability in Windows Kernel can be exploited remotely via specially crafted application to obtain sensitive information.
  5. A remote code execution vulnerability in Hyper-V RemoteFX vGPU can be exploited remotely via specially crafted application to execute arbitrary code.
  6. An elevation of privilege vulnerability in Windows Profile Service can be exploited remotely via specially crafted application to gain privileges.
  7. A denial of service vulnerability in Local Security Authority Subsystem Service can be exploited remotely via specially crafted authentication to cause denial of service.
  8. An elevation of privilege vulnerability in Windows Event Logging Service can be exploited remotely via specially crafted application to gain privileges.
  9. An elevation of privilege vulnerability in Windows UPnP Device Host can be exploited remotely via specially crafted application to gain privileges.
  10. An elevation of privilege vulnerability in Windows Network Connections Service can be exploited remotely via specially crafted application to gain privileges.
  11. A remote code execution vulnerability in GDI+ can be exploited remotely via specially crafted website to execute arbitrary code.
  12. A remote code execution vulnerability in Microsoft Graphics Components can be exploited remotely via specially crafted file to execute arbitrary code.
  13. An elevation of privilege vulnerability in Windows Network Location Awareness Service can be exploited remotely via specially crafted application to gain privileges.
  14. A remote code execution vulnerability in Windows Font Library can be exploited remotely via specially crafted fonts to execute arbitrary code.
  15. An elevation of privilege vulnerability in Windows ALPC can be exploited remotely via specially crafted application to gain privileges.
  16. An information disclosure vulnerability in Windows Imaging Component can be exploited remotely via specially crafted website to obtain sensitive information.
  17. An elevation of privilege vulnerability in Windows Network Connections Service can be exploited to gain privileges.
  18. A remote code execution vulnerability in Windows DNS Server can be exploited remotely to execute arbitrary code.
  19. An information disclosure vulnerability in Microsoft Graphics Component can be exploited remotely via specially crafted application to obtain sensitive information.
  20. A remote code execution vulnerability in Windows Address Book can be exploited remotely to execute arbitrary code.
  21. A remote code execution vulnerability in Remote Desktop Client can be exploited remotely to execute arbitrary code.
  22. An elevation of privilege vulnerability in Windows Function Discovery Service can be exploited remotely via specially crafted application to gain privileges.
  23. A remote code execution vulnerability in Jet Database Engine can be exploited remotely via specially crafted file to execute arbitrary code.
  24. A remote code execution vulnerability in Windows Jet Database Enginecan be exploited via specially crafted file to execute arbitrary code.
  25. An elevation of privilege vulnerability in Windows ActiveX Installer Service can be exploited remotely via specially crafted application to gain privileges.
  26. A remote code execution vulnerability in VBScript can be exploited remotely via specially crafted website to execute arbitrary code.
  27. An information disclosure vulnerability in Windows GDI can be exploited remotely via specially crafted document to obtain sensitive information.
  28. A remote code execution vulnerability in Microsoft Graphics can be exploited remotely via specially crafted embedded to execute arbitrary code.
  29. A remote code execution vulnerability in DirectWrite can be exploited remotely via specially crafted document to execute arbitrary code.
  30. A remote code execution vulnerability in LNK can be exploited remotely to execute arbitrary code.

Первичный источник обнаружения

Эксплуатация

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Связанные продукты

Список CVE

  • CVE-2020-1403
    critical
  • CVE-2020-1333
    warning
  • CVE-2020-1384
    warning
  • CVE-2020-1346
    warning
  • CVE-2020-1389
    warning
  • CVE-2020-1032
    critical
  • CVE-2020-1036
    critical
  • CVE-2020-1360
    warning
  • CVE-2020-1267
    warning
  • CVE-2020-1365
    warning
  • CVE-2020-1354
    warning
  • CVE-2020-1419
    warning
  • CVE-2020-1438
    warning
  • CVE-2020-1435
    critical
  • CVE-2020-1412
    critical
  • CVE-2020-1437
    warning
  • CVE-2020-1436
    high
  • CVE-2020-1430
    warning
  • CVE-2020-1428
    warning
  • CVE-2020-1396
    warning
  • CVE-2020-1397
    warning
  • CVE-2020-1390
    warning
  • CVE-2020-1359
    warning
  • CVE-2020-1371
    warning
  • CVE-2020-1350
    critical
  • CVE-2020-1351
    warning
  • CVE-2020-1040
    critical
  • CVE-2020-1041
    critical
  • CVE-2020-1042
    critical
  • CVE-2020-1043
    critical
  • CVE-2020-1373
    warning
  • CVE-2020-1410
    critical
  • CVE-2020-1374
    high
  • CVE-2020-1085
    warning
  • CVE-2020-1407
    critical
  • CVE-2020-1400
    critical
  • CVE-2020-1401
    critical
  • CVE-2020-1402
    high
  • CVE-2020-1427
    warning
  • CVE-2020-1468
    warning
  • CVE-2020-1408
    critical
  • CVE-2020-1409
    critical
  • CVE-2020-1421
    critical

Список KB

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com

Нашли неточность в описании этой уязвимости? Дайте нам знать!
Kaspersky IT Security Calculator:
Оцените ваш профиль кибербезопасности
Узнать больше
Встречай новый Kaspersky!
Каждая минута твоей онлайн-жизни заслуживает топовой защиты.
Узнать больше
Confirm changes?
Your message has been sent successfully.