| Descripción: | Summary:
This host is missing a critical security
update according to Microsoft KB4343898
Vulnerability Insight:
Multiple flaws exist due to:
- A new speculative execution side channel vulnerability known as L1 Terminal
Fault.
- 'Microsoft COM for Windows' fails to properly handle serialized objects.
- Windows kernel improperly handles objects in memory.
- NDIS fails to check the length of a buffer prior to copying memory to it.
- Active Directory Federation Services (AD FS) improperly handles multi-factor
authentication requests.
- Windows font library improperly handles specially crafted embedded fonts.
- Windows GDI component improperly discloses the contents of its memory.
- Internet Explorer improperly validates hyperlinks before loading executable
libraries.
- Scripting engine handles objects in memory in Microsoft browsers.
- Microsoft browsers improperly allow cross-frame interaction.
- Windows Installer fails to properly sanitize input leading to an insecure library
loading behavior.
- Microsoft browsers improperly access objects in memory.
- Windows Win32k component fails to properly handle objects in memory.
- The DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in
memory.
Vulnerability Impact:
Successful exploitation will allow an attacker
to execute arbitrary code, run processes in an elevated context, obtain
information to further compromise the user's system, trick a user into believing
that the user was on a legitimate website, read privileged data across trust
boundaries and also bypass certain security restrictions.
Affected Software/OS:
- Microsoft Windows 8.1 for 32-bit/x64
- Microsoft Windows Server 2012 R2
Solution:
The vendor has released updates. Please see the references for more information.
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
