| Descripción: | Summary:
This host is missing a critical security
update according to Microsoft KB4471332
Vulnerability Insight:
Multiple flaws exist due to:
- Windows kernel fails to properly handle objects in memory.
- Connected User Experiences and Telemetry Service fails to validate
certain function values.
- Chakra scripting engine improperly handles objects in memory in Microsoft Edge.
- Internet Explorer VBScript execution policy does not properly restrict
VBScript under specific conditions.
- VBScript engine improperly handles objects in memory.
- Windows Domain Name System (DNS) servers fail to properly handle requests.
- Scripting engine handles objects in memory in Internet Explorer.
- Windows kernel-mode driver fails to properly handle objects in memory.
- Windows GDI component improperly discloses the contents of its memory.
- Diagnostics Hub Standard Collector Service improperly impersonates certain
file operations.
- Remote Procedure Call runtime improperly initializes objects in memory.
- Windows Win32k component fails to properly handle objects in memory.
- DirectX improperly handles objects in memory.
- An error in Windows kernel that could allow an attacker to retrieve information that
could lead to a Kernel Address Space Layout Randomization (KASLR) bypass.
- Microsoft text-to-speech fails to properly handle objects in the memory.
- Internet Explorer improperly accesses objects in memory.
Vulnerability Impact:
Successful exploitation will allow an attacker
to run arbitrary code in kernel mode, deny dependent security feature
functionality, gain elevated privileges, disclose sensitive information, cause
denial of service condition and take control of the affected system.
Affected Software/OS:
- Microsoft Windows 10 Version 1809 for 32-bit Systems
- Microsoft Windows 10 Version 1809 for x64-based Systems
Solution:
The vendor has released updates. Please see the references for more information.
CVSS Score:
10.0
CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C
|
