| Description: | Summary:
This host is missing a critical security
update according to Microsoft KB4284860
Vulnerability Insight:
Multiple flaws exist due to errors,
- When the Windows kernel improperly handles objects in memory.
- When Windows improperly handles objects in memory.
- When the (Human Interface Device) HID Parser Library driver improperly handles
objects in memory.
- When Windows allows a normal user to access the Wireless LAN profile of an
administrative user.
- When Microsoft Edge improperly accesses objects in memory.
- When Microsoft Edge improperly handles requests of different origins.
- When Microsoft Edge improperly handles objects in memory.
- When Windows Media Foundation improperly handles objects in memory.
- In the way that the Windows Code Integrity Module performs hashing.
- When Internet Explorer improperly accesses objects in memory.
- When NTFS improperly checks access.
- In the way that the Chakra scripting engine handles objects in memory in
Microsoft Edge.
- In the way that the scripting engine handles objects in memory in Internet
Explorer.
- In Windows Domain Name System (DNS) DNSAPI.
Vulnerability Impact:
Successful exploitation will allow an attacker
to obtain information to further compromise the user's system, run processes in
an elevated context, inject code into a trusted PowerShell process, execute
arbitrary code, read privileged data, force the browser to send restricted data,
interject cross-process communication, install programs, view, change, or delete
data or create new accounts with full user rights and create a denial of service
condition.
Affected Software/OS:
- Microsoft Windows 10 for 32-bit Systems
- Microsoft Windows 10 for x64-based Systems
Solution:
The vendor has released updates. Please see the references for more information.
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
