106402

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0541

46536

The Microsoft Office Viewer Products are missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists in     Microsoft Word software when it fails to properly handle     objects in memory. An attacker who successfully     exploited the vulnerability could use a specially     crafted file to perform actions in the security context     of the current user. For example, the file could then     take actions on behalf of the logged-on user with the     same permissions as the current user.  (CVE-2019-0585)

  - A remote code execution vulnerability exists in the way     that the MSHTML engine inproperly validates input. An     attacker could execute arbitrary code in the context of     the current user.  (CVE-2019-0541)

The Microsoft Office Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability exists in the way     that the MSHTML engine improperly validates input. An     attacker could execute arbitrary code in the context of     the current user. (CVE-2019-0541)

  - An information disclosure vulnerability exists when     Microsoft Outlook improperly handles certain types of     messages. An attacker who successfully exploited this     vulnerability could gather information about the victim.
    An attacker could exploit this vulnerability by sending     a specially crafted email to the victim. The update     addresses the vulnerability by correcting the way     Microsoft Outlook handles these types of messages.
    (CVE-2019-0559)

  - An information disclosure vulnerability exists when     Microsoft Office improperly discloses the contents of     its memory. An attacker who exploited the vulnerability     could use the information to compromise the users     computer or data. (CVE-2019-0560)

  - An information disclosure vulnerability exists when     Microsoft Office improperly discloses the contents of     its memory. An attacker who exploited the vulnerability     could use the information to compromise the users     computer or data. (CVE-2019-0560)

  - A remote code execution vulnerability exists in     Microsoft Word software when it fails to properly handle     objects in memory. An attacker who successfully     exploited the vulnerability could use a specially     crafted file to perform actions in the security context     of the current user. For example, the file could then     take actions on behalf of the logged-on user with the     same permissions as the current user. (CVE-2019-0585)

The Internet Explorer installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability :

  - A remote code execution vulnerability exists in the way     that the MSHTML engine inproperly validates input. An     attacker could execute arbitrary code in the context of     the current user.  (CVE-2019-0541)

The remote Windows host is missing security update 4480972 or cumulative update 4480975. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system. An authenticated attacker could exploit this     vulnerability by running a specially crafted     application. The update addresses the vulnerability by     correcting how the Windows kernel handles objects in     memory. (CVE-2019-0569)

  - An information disclosure vulnerability exists in .NET     Framework and .NET Core which allows bypassing Cross-     origin Resource Sharing (CORS) configurations. An     attacker who successfully exploited the vulnerability     could retrieve content, that is normally restricted,     from a web application. The security update addresses     the vulnerability by enforcing CORS configuration to     prevent its bypass. (CVE-2019-0545)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0538, CVE-2019-0575, CVE-2019-0576,     CVE-2019-0577, CVE-2019-0578, CVE-2019-0579,     CVE-2019-0580, CVE-2019-0581, CVE-2019-0582,     CVE-2019-0583, CVE-2019-0584)

  - An elevation of privilege vulnerability exists in the     Microsoft XmlDocument class that could allow an attacker     to escape from the AppContainer sandbox in the browser.
    An attacker who successfully exploited this     vulnerability could gain elevated privileges and break     out of the Edge AppContainer sandbox. The vulnerability     by itself does not allow arbitrary code to run. However,     this vulnerability could be used in conjunction with one     or more vulnerabilities (for example a remote code     execution vulnerability and another elevation of     privilege vulnerability) to take advantage of the     elevated privileges when running. The security update     addresses the vulnerability by modifying how the     Microsoft XmlDocument class enforces sandboxing.
    (CVE-2019-0555)

  - An elevation of privilege vulnerability exists when the     Windows Runtime improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could run arbitrary code in an elevated context. An     attacker could exploit this vulnerability by running a     specially crafted application on the victim system. The     update addresses the vulnerability by correcting the way     the Windows Runtime handles objects in memory.
    (CVE-2019-0570)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0536, CVE-2019-0549, CVE-2019-0554)

  - A remote code execution vulnerability exists in the way     that the MSHTML engine inproperly validates input. An     attacker could execute arbitrary code in the context of     the current user.  (CVE-2019-0541)

  - An elevation of privilege vulnerability exists when     Windows improperly handles authentication requests. An     attacker who successfully exploited this vulnerability     could run processes in an elevated context. An attacker     could exploit this vulnerability by running a specially     crafted application on the victim system. The update     addresses the vulnerability by correcting the way     Windows handles authentication requests. (CVE-2019-0543)

The remote Windows host is missing security update 4480973. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0536, CVE-2019-0549, CVE-2019-0554)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2019-0539, CVE-2019-0567)

  - An information disclosure vulnerability exists when     Windows Subsystem for Linux improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system. A attacker could exploit     this vulnerability by running a specially crafted     application. The update addresses the vulnerability by     correcting how Windows Subsystem for Linux handles     objects in memory. (CVE-2019-0553)

  - An information disclosure vulnerability exists in .NET     Framework and .NET Core which allows bypassing Cross-     origin Resource Sharing (CORS) configurations. An     attacker who successfully exploited the vulnerability     could retrieve content, that is normally restricted,     from a web application. The security update addresses     the vulnerability by enforcing CORS configuration to     prevent its bypass. (CVE-2019-0545)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0538, CVE-2019-0575, CVE-2019-0576,     CVE-2019-0577, CVE-2019-0578, CVE-2019-0579,     CVE-2019-0580, CVE-2019-0581, CVE-2019-0582,     CVE-2019-0583, CVE-2019-0584)

  - An elevation of privilege vulnerability exists in the     Microsoft XmlDocument class that could allow an attacker     to escape from the AppContainer sandbox in the browser.
    An attacker who successfully exploited this     vulnerability could gain elevated privileges and break     out of the Edge AppContainer sandbox. The vulnerability     by itself does not allow arbitrary code to run. However,     this vulnerability could be used in conjunction with one     or more vulnerabilities (for example a remote code     execution vulnerability and another elevation of     privilege vulnerability) to take advantage of the     elevated privileges when running. The security update     addresses the vulnerability by modifying how the     Microsoft XmlDocument class enforces sandboxing.
    (CVE-2019-0555)

  - An elevation of privilege vulnerability exists when     Windows improperly handles authentication requests. An     attacker who successfully exploited this vulnerability     could run processes in an elevated context. An attacker     could exploit this vulnerability by running a specially     crafted application on the victim system. The update     addresses the vulnerability by correcting the way     Windows handles authentication requests. (CVE-2019-0543)

  - An elevation of privilege vulnerability exists when the     Windows Runtime improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could run arbitrary code in an elevated context. An     attacker could exploit this vulnerability by running a     specially crafted application on the victim system. The     update addresses the vulnerability by correcting the way     the Windows Runtime handles objects in memory.
    (CVE-2019-0570)

  - A remote code execution vulnerability exists in the way     that the MSHTML engine inproperly validates input. An     attacker could execute arbitrary code in the context of     the current user.  (CVE-2019-0541)

  - A remote code execution vulnerability exists when     Windows Hyper-V on a host server fails to properly     validate input from an authenticated user on a guest     operating system.  (CVE-2019-0551)

  - An elevation of privilege exists in Windows COM Desktop     Broker. An attacker who successfully exploited the     vulnerability could run arbitrary code with elevated     privileges.  (CVE-2019-0552)

  - An elevation of privilege vulnerability exists in     Microsoft Edge Browser Broker COM object. An attacker     who successfully exploited the vulnerability could use     the Browser Broker COM object to elevate privileges on     an affected system. This vulnerability by itself does     not allow arbitrary code execution; however, it could     allow arbitrary code to be run if the attacker uses it     in combination with another vulnerability (such as a     remote code execution vulnerability or another elevation     of privilege vulnerability) that is capable of     leveraging the elevated privileges when code execution     is attempted. (CVE-2019-0566)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system. An authenticated attacker could exploit this     vulnerability by running a specially crafted     application. The update addresses the vulnerability by     correcting how the Windows kernel handles objects in     memory. (CVE-2019-0569)

  - An elevation of privilege vulnerability exists when the     Windows Data Sharing Service improperly handles file     operations. An attacker who successfully exploited this     vulnerability could run processes in an elevated     context. An attacker could exploit this vulnerability by     running a specially crafted application on the victim     system. The update addresses the vulnerability by     correcting the way the Windows Data Sharing Service     handles file operations. (CVE-2019-0571, CVE-2019-0572,     CVE-2019-0573, CVE-2019-0574)

The remote Windows host is missing security update 4480960 or cumulative update 4480970. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system. An authenticated attacker could exploit this     vulnerability by running a specially crafted     application. The update addresses the vulnerability by     correcting how the Windows kernel handles objects in     memory. (CVE-2019-0569)

  - An information disclosure vulnerability exists in .NET     Framework and .NET Core which allows bypassing Cross-     origin Resource Sharing (CORS) configurations. An     attacker who successfully exploited the vulnerability     could retrieve content, that is normally restricted,     from a web application. The security update addresses     the vulnerability by enforcing CORS configuration to     prevent its bypass. (CVE-2019-0545)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0538, CVE-2019-0575, CVE-2019-0576,     CVE-2019-0577, CVE-2019-0578, CVE-2019-0579,     CVE-2019-0580, CVE-2019-0581, CVE-2019-0582,     CVE-2019-0583, CVE-2019-0584)

  - A remote code execution vulnerability exists in the way     that the MSHTML engine improperly validates input. An     attacker could execute arbitrary code in the context of     the current user.  (CVE-2019-0541)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0536, CVE-2019-0549, CVE-2019-0554)

  - An elevation of privilege vulnerability exists when     Windows improperly handles authentication requests. An     attacker who successfully exploited this vulnerability     could run processes in an elevated context. An attacker     could exploit this vulnerability by running a specially     crafted application on the victim system. The update     addresses the vulnerability by correcting the way     Windows handles authentication requests. (CVE-2019-0543)

The remote Windows host is missing security update 4480957 or cumulative update 4480968. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system. An authenticated attacker could exploit this     vulnerability by running a specially crafted     application. The update addresses the vulnerability by     correcting how the Windows kernel handles objects in     memory. (CVE-2019-0569)

  - An information disclosure vulnerability exists in .NET     Framework and .NET Core which allows bypassing Cross-     origin Resource Sharing (CORS) configurations. An     attacker who successfully exploited the vulnerability     could retrieve content, that is normally restricted,     from a web application. The security update addresses     the vulnerability by enforcing CORS configuration to     prevent its bypass. (CVE-2019-0545)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0538, CVE-2019-0575, CVE-2019-0576,     CVE-2019-0577, CVE-2019-0578, CVE-2019-0579,     CVE-2019-0580, CVE-2019-0581, CVE-2019-0582,     CVE-2019-0583, CVE-2019-0584)

  - A remote code execution vulnerability exists in the way     that the MSHTML engine inproperly validates input. An     attacker could execute arbitrary code in the context of     the current user.  (CVE-2019-0541)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0536, CVE-2019-0549, CVE-2019-0554)

  - An elevation of privilege vulnerability exists when     Windows improperly handles authentication requests. An     attacker who successfully exploited this vulnerability     could run processes in an elevated context. An attacker     could exploit this vulnerability by running a specially     crafted application on the victim system. The update     addresses the vulnerability by correcting the way     Windows handles authentication requests. (CVE-2019-0543)

The remote Windows host is missing security update 4480964 or cumulative update 4480963. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0536, CVE-2019-0549, CVE-2019-0554)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0538, CVE-2019-0575, CVE-2019-0576,     CVE-2019-0577, CVE-2019-0578, CVE-2019-0579,     CVE-2019-0580, CVE-2019-0581, CVE-2019-0582,     CVE-2019-0583, CVE-2019-0584)

  - An information disclosure vulnerability exists in .NET     Framework and .NET Core which allows bypassing Cross-     origin Resource Sharing (CORS) configurations. An     attacker who successfully exploited the vulnerability     could retrieve content, that is normally restricted,     from a web application. The security update addresses     the vulnerability by enforcing CORS configuration to     prevent its bypass. (CVE-2019-0545)

  - An elevation of privilege vulnerability exists in the     Microsoft XmlDocument class that could allow an attacker     to escape from the AppContainer sandbox in the browser.
    An attacker who successfully exploited this     vulnerability could gain elevated privileges and break     out of the Edge AppContainer sandbox. The vulnerability     by itself does not allow arbitrary code to run. However,     this vulnerability could be used in conjunction with one     or more vulnerabilities (for example a remote code     execution vulnerability and another elevation of     privilege vulnerability) to take advantage of the     elevated privileges when running. The security update     addresses the vulnerability by modifying how the     Microsoft XmlDocument class enforces sandboxing.
    (CVE-2019-0555)

  - An elevation of privilege vulnerability exists when the     Windows Runtime improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could run arbitrary code in an elevated context. An     attacker could exploit this vulnerability by running a     specially crafted application on the victim system. The     update addresses the vulnerability by correcting the way     the Windows Runtime handles objects in memory.
    (CVE-2019-0570)

  - A remote code execution vulnerability exists in the way     that the MSHTML engine improperly validates input. An     attacker could execute arbitrary code in the context of     the current user.  (CVE-2019-0541)

  - An elevation of privilege exists in Windows COM Desktop     Broker. An attacker who successfully exploited the     vulnerability could run arbitrary code with elevated     privileges.  (CVE-2019-0552)

  - An elevation of privilege vulnerability exists when     Windows improperly handles authentication requests. An     attacker who successfully exploited this vulnerability     could run processes in an elevated context. An attacker     could exploit this vulnerability by running a specially     crafted application on the victim system. The update     addresses the vulnerability by correcting the way     Windows handles authentication requests. (CVE-2019-0543)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system. An authenticated attacker could exploit this     vulnerability by running a specially crafted     application. The update addresses the vulnerability by     correcting how the Windows kernel handles objects in     memory. (CVE-2019-0569)

The remote Windows host is missing security update 4480962. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0536, CVE-2019-0549, CVE-2019-0554)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2019-0539, CVE-2019-0567)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0538, CVE-2019-0575, CVE-2019-0576,     CVE-2019-0577, CVE-2019-0578, CVE-2019-0579,     CVE-2019-0580, CVE-2019-0581, CVE-2019-0582,     CVE-2019-0583, CVE-2019-0584)

  - An information disclosure vulnerability exists in .NET     Framework and .NET Core which allows bypassing Cross-     origin Resource Sharing (CORS) configurations. An     attacker who successfully exploited the vulnerability     could retrieve content, that is normally restricted,     from a web application. The security update addresses     the vulnerability by enforcing CORS configuration to     prevent its bypass. (CVE-2019-0545)

  - An elevation of privilege vulnerability exists in the     Microsoft XmlDocument class that could allow an attacker     to escape from the AppContainer sandbox in the browser.
    An attacker who successfully exploited this     vulnerability could gain elevated privileges and break     out of the Edge AppContainer sandbox. The vulnerability     by itself does not allow arbitrary code to run. However,     this vulnerability could be used in conjunction with one     or more vulnerabilities (for example a remote code     execution vulnerability and another elevation of     privilege vulnerability) to take advantage of the     elevated privileges when running. The security update     addresses the vulnerability by modifying how the     Microsoft XmlDocument class enforces sandboxing.
    (CVE-2019-0555)

  - An elevation of privilege vulnerability exists when     Windows improperly handles authentication requests. An     attacker who successfully exploited this vulnerability     could run processes in an elevated context. An attacker     could exploit this vulnerability by running a specially     crafted application on the victim system. The update     addresses the vulnerability by correcting the way     Windows handles authentication requests. (CVE-2019-0543)

  - An elevation of privilege vulnerability exists when the     Windows Runtime improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could run arbitrary code in an elevated context. An     attacker could exploit this vulnerability by running a     specially crafted application on the victim system. The     update addresses the vulnerability by correcting the way     the Windows Runtime handles objects in memory.
    (CVE-2019-0570)

  - A remote code execution vulnerability exists in the way     that the MSHTML engine inproperly validates input. An     attacker could execute arbitrary code in the context of     the current user.  (CVE-2019-0541)

  - An elevation of privilege exists in Windows COM Desktop     Broker. An attacker who successfully exploited the     vulnerability could run arbitrary code with elevated     privileges.  (CVE-2019-0552)

  - An elevation of privilege vulnerability exists in     Microsoft Edge Browser Broker COM object. An attacker     who successfully exploited the vulnerability could use     the Browser Broker COM object to elevate privileges on     an affected system. This vulnerability by itself does     not allow arbitrary code execution; however, it could     allow arbitrary code to be run if the attacker uses it     in combination with another vulnerability (such as a     remote code execution vulnerability or another elevation     of privilege vulnerability) that is capable of     leveraging the elevated privileges when code execution     is attempted. (CVE-2019-0566)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system. An authenticated attacker could exploit this     vulnerability by running a specially crafted     application. The update addresses the vulnerability by     correcting how the Windows kernel handles objects in     memory. (CVE-2019-0569)

  - An elevation of privilege vulnerability exists when the     Windows Data Sharing Service improperly handles file     operations. An attacker who successfully exploited this     vulnerability could run processes in an elevated     context. An attacker could exploit this vulnerability by     running a specially crafted application on the victim     system. The update addresses the vulnerability by     correcting the way the Windows Data Sharing Service     handles file operations. (CVE-2019-0571, CVE-2019-0572,     CVE-2019-0573, CVE-2019-0574)

The remote Windows host is missing security update 4480961. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0536, CVE-2019-0549, CVE-2019-0554)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2019-0539, CVE-2019-0567)

  - An information disclosure vulnerability exists in .NET     Framework and .NET Core which allows bypassing Cross-     origin Resource Sharing (CORS) configurations. An     attacker who successfully exploited the vulnerability     could retrieve content, that is normally restricted,     from a web application. The security update addresses     the vulnerability by enforcing CORS configuration to     prevent its bypass. (CVE-2019-0545)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0538, CVE-2019-0575, CVE-2019-0576,     CVE-2019-0577, CVE-2019-0578, CVE-2019-0579,     CVE-2019-0580, CVE-2019-0581, CVE-2019-0582,     CVE-2019-0583, CVE-2019-0584)

  - An elevation of privilege vulnerability exists in the     Microsoft XmlDocument class that could allow an attacker     to escape from the AppContainer sandbox in the browser.
    An attacker who successfully exploited this     vulnerability could gain elevated privileges and break     out of the Edge AppContainer sandbox. The vulnerability     by itself does not allow arbitrary code to run. However,     this vulnerability could be used in conjunction with one     or more vulnerabilities (for example a remote code     execution vulnerability and another elevation of     privilege vulnerability) to take advantage of the     elevated privileges when running. The security update     addresses the vulnerability by modifying how the     Microsoft XmlDocument class enforces sandboxing.
    (CVE-2019-0555)

  - An elevation of privilege vulnerability exists when     Windows improperly handles authentication requests. An     attacker who successfully exploited this vulnerability     could run processes in an elevated context. An attacker     could exploit this vulnerability by running a specially     crafted application on the victim system. The update     addresses the vulnerability by correcting the way     Windows handles authentication requests. (CVE-2019-0543)

  - An elevation of privilege vulnerability exists when the     Windows Runtime improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could run arbitrary code in an elevated context. An     attacker could exploit this vulnerability by running a     specially crafted application on the victim system. The     update addresses the vulnerability by correcting the way     the Windows Runtime handles objects in memory.
    (CVE-2019-0570)

  - A remote code execution vulnerability exists in the way     that the MSHTML engine inproperly validates input. An     attacker could execute arbitrary code in the context of     the current user.  (CVE-2019-0541)

  - A remote code execution vulnerability exists when     Windows Hyper-V on a host server fails to properly     validate input from an authenticated user on a guest     operating system.  (CVE-2019-0551)

  - An elevation of privilege exists in Windows COM Desktop     Broker. An attacker who successfully exploited the     vulnerability could run arbitrary code with elevated     privileges.  (CVE-2019-0552)

  - An elevation of privilege vulnerability exists in     Microsoft Edge Browser Broker COM object. An attacker     who successfully exploited the vulnerability could use     the Browser Broker COM object to elevate privileges on     an affected system. This vulnerability by itself does     not allow arbitrary code execution; however, it could     allow arbitrary code to be run if the attacker uses it     in combination with another vulnerability (such as a     remote code execution vulnerability or another elevation     of privilege vulnerability) that is capable of     leveraging the elevated privileges when code execution     is attempted. (CVE-2019-0566)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system. An authenticated attacker could exploit this     vulnerability by running a specially crafted     application. The update addresses the vulnerability by     correcting how the Windows kernel handles objects in     memory. (CVE-2019-0569)

  - An elevation of privilege vulnerability exists when the     Windows Data Sharing Service improperly handles file     operations. An attacker who successfully exploited this     vulnerability could run processes in an elevated     context. An attacker could exploit this vulnerability by     running a specially crafted application on the victim     system. The update addresses the vulnerability by     correcting the way the Windows Data Sharing Service     handles file operations. (CVE-2019-0571, CVE-2019-0572,     CVE-2019-0573, CVE-2019-0574)

The remote Windows host is missing security update 4480116.
It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-0536, CVE-2019-0549, CVE-2019-0554)

  - A remote code execution vulnerability exists in the way     that the Chakra scripting engine handles objects in     memory in Microsoft Edge. The vulnerability could     corrupt memory in such a way that an attacker could     execute arbitrary code in the context of the current     user. An attacker who successfully exploited the     vulnerability could gain the same user rights as the     current user.  (CVE-2019-0539, CVE-2019-0567,     CVE-2019-0568)

  - An information disclosure vulnerability exists when     Windows Subsystem for Linux improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could obtain information to further     compromise the users system. A attacker could exploit     this vulnerability by running a specially crafted     application. The update addresses the vulnerability by     correcting how Windows Subsystem for Linux handles     objects in memory. (CVE-2019-0553)

  - An information disclosure vulnerability exists in .NET     Framework and .NET Core which allows bypassing Cross-     origin Resource Sharing (CORS) configurations. An     attacker who successfully exploited the vulnerability     could retrieve content, that is normally restricted,     from a web application. The security update addresses     the vulnerability by enforcing CORS configuration to     prevent its bypass. (CVE-2019-0545)

  - A remote code execution vulnerability exists when     Windows Hyper-V on a host server fails to properly     validate input from an authenticated user on a guest     operating system.  (CVE-2019-0550, CVE-2019-0551)

  - A remote code execution vulnerability exists when the     Windows Jet Database Engine improperly handles objects     in memory. An attacker who successfully exploited this     vulnerability could execute arbitrary code on a victim     system. An attacker could exploit this vulnerability by     enticing a victim to open a specially crafted file. The     update addresses the vulnerability by correcting the way     the Windows Jet Database Engine handles objects in     memory. (CVE-2019-0538, CVE-2019-0575, CVE-2019-0576,     CVE-2019-0577, CVE-2019-0578, CVE-2019-0579,     CVE-2019-0580, CVE-2019-0581, CVE-2019-0582,     CVE-2019-0583, CVE-2019-0584)

  - A remote code execution vulnerability exists when     Microsoft Edge improperly accesses objects in memory.
    The vulnerability could corrupt memory in such a way     that enables an attacker to execute arbitrary code in     the context of the current user. An attacker who     successfully exploited the vulnerability could gain the     same user rights as the current user.  (CVE-2019-0565)

  - An elevation of privilege vulnerability exists in the     Microsoft XmlDocument class that could allow an attacker     to escape from the AppContainer sandbox in the browser.
    An attacker who successfully exploited this     vulnerability could gain elevated privileges and break     out of the Edge AppContainer sandbox. The vulnerability     by itself does not allow arbitrary code to run. However,     this vulnerability could be used in conjunction with one     or more vulnerabilities (for example a remote code     execution vulnerability and another elevation of     privilege vulnerability) to take advantage of the     elevated privileges when running. The security update     addresses the vulnerability by modifying how the     Microsoft XmlDocument class enforces sandboxing.
    (CVE-2019-0555)

  - An elevation of privilege vulnerability exists when     Windows improperly handles authentication requests. An     attacker who successfully exploited this vulnerability     could run processes in an elevated context. An attacker     could exploit this vulnerability by running a specially     crafted application on the victim system. The update     addresses the vulnerability by correcting the way     Windows handles authentication requests. (CVE-2019-0543)

  - An elevation of privilege vulnerability exists when the     Windows Runtime improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could run arbitrary code in an elevated context. An     attacker could exploit this vulnerability by running a     specially crafted application on the victim system. The     update addresses the vulnerability by correcting the way     the Windows Runtime handles objects in memory.
    (CVE-2019-0570)

  - A remote code execution vulnerability exists in the way     that the MSHTML engine inproperly validates input. An     attacker could execute arbitrary code in the context of     the current user.  (CVE-2019-0541)

  - An elevation of privilege exists in Windows COM Desktop     Broker. An attacker who successfully exploited the     vulnerability could run arbitrary code with elevated     privileges.  (CVE-2019-0552)

  - An elevation of privilege vulnerability exists in     Microsoft Edge Browser Broker COM object. An attacker     who successfully exploited the vulnerability could use     the Browser Broker COM object to elevate privileges on     an affected system. This vulnerability by itself does     not allow arbitrary code execution; however, it could     allow arbitrary code to be run if the attacker uses it     in combination with another vulnerability (such as a     remote code execution vulnerability or another elevation     of privilege vulnerability) that is capable of     leveraging the elevated privileges when code execution     is attempted. (CVE-2019-0566)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system. An authenticated attacker could exploit this     vulnerability by running a specially crafted     application. The update addresses the vulnerability by     correcting how the Windows kernel handles objects in     memory. (CVE-2019-0569)

  - An elevation of privilege vulnerability exists when the     Windows Data Sharing Service improperly handles file     operations. An attacker who successfully exploited this     vulnerability could run processes in an elevated     context. An attacker could exploit this vulnerability by     running a specially crafted application on the victim     system. The update addresses the vulnerability by     correcting the way the Windows Data Sharing Service     handles file operations. (CVE-2019-0571, CVE-2019-0572,     CVE-2019-0573, CVE-2019-0574)

ID	Name	Product	Family	Severity
121025	Security Updates for Microsoft Office Viewer Products (January 2019)	Nessus	Windows : Microsoft Bulletins	high
121024	Security Updates for Microsoft Office Products (January 2019)	Nessus	Windows : Microsoft Bulletins	high
121023	Security Updates for Internet Explorer (January 2019)	Nessus	Windows : Microsoft Bulletins	high
121019	KB4480972: Windows Server 2012 January 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high
121018	KB4480973: Windows 10 Version 1703 January 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high
121017	KB4480960: Windows 7 and Windows Server 2008 R2 January 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high
121016	KB4480957: Windows Server 2008 January 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high
121014	KB4480964: Windows 8.1 and Windows Server 2012 R2 January 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high
121013	KB4480962: Windows 10 January 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high
121012	KB4480961: Windows 10 Version 1607 and Windows Server 2016 January 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high
121011	KB4480116: Windows 10 Version 1809 and Windows Server 2019 January 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high

CVE-2019-0541

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Configuration 3

Configuration 4

Tenable Plugins