| Descripción: | Summary:
This host is missing a critical security
update according to Microsoft KB4457142
Vulnerability Insight:
Multiple flaws exist due to:
- An error in the way that the Chakra scripting engine handles objects in memory.
- An error when Microsoft Edge PDF Reader improperly handles objects in memory.
- An error when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles
objects in memory.
- An error when Internet Explorer improperly accesses objects in memory.
- An error in Windows that allows a sandbox escape.
- An error in Microsoft Edge that could allow an attacker to escape from the
AppContainer sandbox in the browser.
- An error in Internet Explorer due to how scripts are handled that allows a
universal cross-site scripting (UXSS) condition.
- An error when Windows Hyper-V on a host server fails to properly validate input
from an authenticated user on a guest operating system.
- An error when Microsoft Hyper-V Network Switch on a host server fails to properly
validate input from a privileged user on a guest operating system.
- An error in the Microsoft JET Database Engine that could allow remote code
execution on an affected system.
- An error when the Windows Kernel API improperly handles registry objects in memory.
- An error when the Windows kernel improperly handles objects in memory.
- An error when the Windows Graphics component improperly handles objects in memory.
- An error when Windows Hyper-V BIOS loader fails to provide a high-entropy source.
- An error when Windows Hyper-V on a host operating system fails to properly
validate input from an authenticated user on a guest operating system.
- An error when the Windows kernel fails to properly initialize a memory address.
- A security feature bypass exists when Device Guard incorrectly validates an
untrusted file.
- An error when Windows does not properly handle specially crafted image files.
- An error when the scripting engine does not properly handle objects in memory in
Microsoft browsers.
- An error in the way that the Windows Kernel handles objects in memory.
- An error when Windows Subsystem for Linux improperly handles case sensitivity.
- An error in the Microsoft Server Block Message (SMB) when an attacker sends
specially crafted requests to the server.
- Microsoft is aware of a denial of service vulnerability (named FragmentSmack
CVE-2018-5391) affecting Windows systems.
- An error when the Windows font library improperly handles specially crafted
embedded fonts.
- An error when the Microsoft XML Core Services MSXML parser processes user
input.
- An error when Windows improperly handles calls to Advanced Local Procedure
Call (ALPC).
- An error when the Windows GDI component improperly discloses the contents of its
memory.
- An error when Microsoft Edge improperly handles specific HTML content.
Vulnerability Impact:
Successful exploitation will allow remote
attacker to gain the same user rights as the current user, run processes in
an elevated context, escape sandbox, access any session, execute arbitrary code,
conduct a DoS condition, take complete control of an affected system, disclose
contents of System memory, gain access to sensitive information, bypass security
restrictions, make an unsigned file appear to be signed and replace or delete
arbitrary files.
Affected Software/OS:
- Microsoft Windows 10 Version 1709 for 32-bit Systems
- Microsoft Windows 10 Version 1709 for 64-based Systems
Solution:
The vendor has released updates. Please see the references for more information.
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
