| Beschreibung: | Summary:
This host is missing a critical security
update according to Microsoft KB4038777
Vulnerability Insight:
Multiple flaws exist due to:
- An error when Windows Hyper-V on a host operating system fails to properly
validate input from an authenticated user on a guest operating system.
- An issue when the Windows kernel fails to properly initialize a memory address.
- An error when the Windows kernel improperly handles objects in memory.
- An error in Microsoft's implementation of the Bluetooth stack.
- An error in the way that Microsoft browser JavaScript engines render content when
handling objects in memory.
- An error when Windows Uniscribe improperly discloses the contents of its memory.
- An error due to the way Windows Uniscribe handles objects in memory.
- An error when Microsoft browsers improperly access objects in memory.
- An error when Internet Explorer improperly handles specific HTML content.
- An error in Microsoft browsers due to improper parent domain verification in
certain functionality.
- An error in the way that the Windows Graphics Device Interface (GDI) handles
objects in memory, allowing an attacker to retrieve information from a targeted
system.
- An error when the Windows GDI+ component improperly discloses kernel memory
addresses.
- An error in Windows when the Windows kernel-mode driver fails to properly handle
objects in memory.
- An error when Windows Shell does not properly validate file copy destinations.
- An error in Windows kernel.
- An error when the Windows font library improperly handles specially crafted
embedded fonts.
- An error in the Microsoft Common Console Document.
- An error in Windows when the Win32k component fails to properly handle objects in
memory.
Vulnerability Impact:
Successful exploitation will allow an
attacker to gain access to potentially sensitive information, perform a
man-in-the-middle attack and force a user's computer to unknowingly route
traffic through the attacker's computer, execute arbitrary code on the target,
embed an ActiveX control marked safe for initialization, take complete control
of the affected system and read arbitrary files on the affected system.
Affected Software/OS:
- Microsoft Windows 7 for 32-bit/x64 Systems Service Pack 1
- Microsoft Windows Server 2008 R2 for x64-based Systems Service Pack 1
Solution:
The vendor has released updates. Please see the references for more information.
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
