An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnerability." This affects Windows Server 2008, Windows 7, Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8419, CVE-2018-8442, CVE-2018-8443, CVE-2018-8445, CVE-2018-8446.

The remote Windows host is missing security update 4457984 or cumulative update 4458010. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in     Windows when the Windows bowser.sys kernel-mode driver     fails to properly handle objects in memory. An attacker     who successfully exploited the vulnerability could     potentially disclose contents of System memory.
    (CVE-2018-8271)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2018-8424)

  - A buffer overflow vulnerability exists in the Microsoft     JET Database Engine that could allow remote code     execution on an affected system. An attacker who     successfully exploited this vulnerability could take     control of an affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose     accounts are configured to have fewer user rights on the     system could be less impacted than users who operate     with administrative user rights.  (CVE-2018-8392,     CVE-2018-8393)

  - A remote code execution vulnerability exists when     Windows does not properly handle specially crafted image     files. An attacker who successfully exploited the     vulnerability could execute arbitrary code.
    (CVE-2018-8475)

  - A remote code execution vulnerability exists when the     Microsoft XML Core Services MSXML parser processes user     input. An attacker who successfully exploited the     vulnerability could run malicious code remotely to take     control of the users system.  (CVE-2018-8420)

  - An information disclosure vulnerability exists when the     Windows Graphics component improperly handles objects in     memory. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system. An authenticated attacker     could exploit this vulnerability by running a specially     crafted application. The update addresses the     vulnerability by correcting how the Windows Graphics     Component handles objects in memory. (CVE-2018-8433)

  - A remote code execution vulnerability exists when     Internet Explorer improperly accesses objects in memory.
    The vulnerability could corrupt memory in such a way     that an attacker could execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2018-8447)

  - An elevation of privilege vulnerability exists when     Windows improperly handles calls to Advanced Local     Procedure Call (ALPC). An attacker who successfully     exploited this vulnerability could run arbitrary code in     the security context of the local system. An attacker     could then install programs; view, change, or delete     data; or create new accounts with full user rights.
    (CVE-2018-8440)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system. An authenticated attacker could exploit this     vulnerability by running a specially crafted     application. The update addresses the vulnerability by     correcting how the Windows kernel handles objects in     memory. (CVE-2018-8442, CVE-2018-8443)

  - An information disclosure vulnerability exists when the     Windows kernel fails to properly initialize a memory     address. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system.  (CVE-2018-8419)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2018-8434)

  - A remote code execution vulnerability exists when the     Windows font library improperly handles specially     crafted embedded fonts. An attacker who successfully     exploited this vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2018-8332)

  - An elevation of privilege vulnerability exists in   Windows that allows a sandbox escape. An attacker who   successfully exploited the vulnerability could use the   sandbox escape to elevate privileges on an affected   system. This vulnerability by itself does not allow   arbitrary code execution. However, the vulnerability   could allow arbitrary code to run if an attacker uses it   in combination with another vulnerability, such as a   remote code execution vulnerability or another elevation   of privilege vulnerability, that can leverage the   elevated privileges when code execution is attempted.
  The security update addresses the vulnerability by   correcting how Windows parses files. (CVE-2018-8468)

  - A remote code execution vulnerability exists when     Microsoft .NET Framework processes input. An attacker     who successfully exploited this vulnerability could take     control of an affected system.  (CVE-2018-8421)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-8336, CVE-2018-8446)

The remote Windows host is missing security update 4457145 or cumulative update 4457144. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in the way     the scripting engine handles objects in memory in     Microsoft browsers. The vulnerability could corrupt     memory in such a way that an attacker could execute     arbitrary code in the context of the current user. An     attacker who successfully exploited the vulnerability     could gain the same user rights as the current user.
    (CVE-2018-8457)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2018-8424)

  - An elevation of privilege vulnerability exists when the     Windows Kernel API improperly handles registry objects     in memory. An attacker who successfully exploited the     vulnerability could gain elevated privileges on a     targeted system. A locally authenticated attacker could     exploit this vulnerability by running a specially     crafted application. The security update addresses the     vulnerability by helping to ensure that the Windows     Kernel API properly handles objects in memory.
    (CVE-2018-8410)

  - An elevation of privilege vulnerability exists when     Windows improperly handles calls to Advanced Local     Procedure Call (ALPC). An attacker who successfully     exploited this vulnerability could run arbitrary code in     the security context of the local system. An attacker     could then install programs; view, change, or delete     data; or create new accounts with full user rights.
    (CVE-2018-8440)

  - A buffer overflow vulnerability exists in the Microsoft     JET Database Engine that could allow remote code     execution on an affected system. An attacker who     successfully exploited this vulnerability could take     control of an affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose     accounts are configured to have fewer user rights on the     system could be less impacted than users who operate     with administrative user rights.  (CVE-2018-8392,     CVE-2018-8393)

  - A remote code execution vulnerability exists when     Windows does not properly handle specially crafted image     files. An attacker who successfully exploited the     vulnerability could execute arbitrary code.
    (CVE-2018-8475)

  - A remote code execution vulnerability exists when     Microsoft .NET Framework processes input. An attacker     who successfully exploited this vulnerability could take     control of an affected system.  (CVE-2018-8421)

  - An information disclosure vulnerability exists when the     Windows Graphics component improperly handles objects in     memory. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system. An authenticated attacker     could exploit this vulnerability by running a specially     crafted application. The update addresses the     vulnerability by correcting how the Windows Graphics     Component handles objects in memory. (CVE-2018-8433)

  - A remote code execution vulnerability exists when     Internet Explorer improperly accesses objects in memory.
    The vulnerability could corrupt memory in such a way     that an attacker could execute arbitrary code in the     context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2018-8447)

  - A remote code execution vulnerability exists when the     Microsoft XML Core Services MSXML parser processes user     input. An attacker who successfully exploited the     vulnerability could run malicious code remotely to take     control of the users system.  (CVE-2018-8420)

  - An information disclosure vulnerability exists when the     scripting engine does not properly handle objects in     memory in Microsoft browsers. An attacker who     successfully exploited the vulnerability could obtain     information to further compromise the users system.
    (CVE-2018-8452)

  - An elevation of privilege vulnerability exists in     Windows that allows a sandbox escape. An attacker who     successfully exploited the vulnerability could use the     sandbox escape to elevate privileges on an affected     system. This vulnerability by itself does not allow     arbitrary code execution. However, the vulnerability     could allow arbitrary code to run if an attacker uses it     in combination with another vulnerability, such as a     remote code execution vulnerability or another elevation     of privilege vulnerability, that can leverage the     elevated privileges when code execution is attempted.
    The security update addresses the vulnerability by     correcting how Windows parses files. (CVE-2018-8468)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system. An authenticated attacker could exploit this     vulnerability by running a specially crafted     application. The update addresses the vulnerability by     correcting how the Windows kernel handles objects in     memory. (CVE-2018-8442, CVE-2018-8443)

  - An information disclosure vulnerability exists when the     Windows kernel fails to properly initialize a memory     address. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system.  (CVE-2018-8419)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2018-8434)

  - An information disclosure vulnerability exists in     Windows when the Windows bowser.sys kernel-mode driver     fails to properly handle objects in memory. An attacker     who successfully exploited the vulnerability could     potentially disclose contents of System memory.
    (CVE-2018-8271)

  - A remote code execution vulnerability exists when the     Windows font library improperly handles specially     crafted embedded fonts. An attacker who successfully     exploited this vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2018-8332)

  - An information disclosure vulnerability exists when the     browser scripting engine improperly handle object types.
    An attacker who has successfully exploited this     vulnerability might be able to read privileged data     across trust boundaries. In browsing scenarios, an     attacker could convince a user to visit a malicious site     and leverage the vulnerability to obtain privileged     information from the browser process, such as sensitive     data from other opened tabs. An attacker could also     inject malicious code into advertising networks used by     trusted sites or embed malicious code on a compromised,     but trusted, site. The security update addresses the     vulnerability by correcting how the browser scripting     engine handles object types. (CVE-2018-8315)

  - A security feature bypass vulnerability exists in     Internet Explorer due to how scripts are handled that     allows a universal cross-site scripting (UXSS)     condition. An attacker could use the UXSS vulnerability     to access any session belonging to web pages currently     opened (or cached) by the browser at the time the attack     is triggered.  (CVE-2018-8470)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2018-8336, CVE-2018-8446)

ID	Name	Product	Family	Severity
117420	KB4457984: Windows Server 2008 September 2018 Security Update	Nessus	Windows : Microsoft Bulletins	critical
117418	KB4457145: Windows 7 and Windows Server 2008 R2 September 2018 Security Update	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2018-8336

medium

Tenable Plugins

critical

critical