| Description: | Summary:
This host is missing a critical security
update according to Microsoft KB4074598
Vulnerability Insight:
Multiple flaws exist due to:
- The software fails to properly handle objects in memory.
- The Microsoft Windows Embedded OpenType (EOT) font engine fails to properly
parse specially crafted embedded fonts.
- The scripting engine improperly handles objects in memory.
- The Windows Common Log File System (CLFS) driver improperly handles objects
in memory.
- The VBScript improperly discloses the contents of its memory.
- The Windows Kernel handles objects in memory.
- The Windows kernel fails to properly initialize a memory address.
- Microsoft has deprecated the Document Signing functionality in XPS Viewer.
Vulnerability Impact:
Successful exploitation will allow an attacker
who successfully exploited the vulnerability to run arbitrary code in the
context of the current user, read data that was not intended to be disclosed,
gain the same user rights as the current user, obtain information to further
compromise the user's system, spoof content, perform phishing attacks, or
otherwise manipulate content of a document.
Affected Software/OS:
- Microsoft Windows 7 for 32-bit/x64 Systems Service Pack 1
- Microsoft Windows Server 2008 R2 for x64-based Systems Service Pack 1
Solution:
The vendor has released updates. Please see the references for more information.
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
