Microsoft Patch Tuesday — April 2018
Tuesday, 10 April 2018
- Vulnerabilities
- 65
- Critical
- 0
- High
- 7
- Zero-days
- 0
- Public exploit
- 12
Exploited 0
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
None of this release's vulnerabilities is known to be exploited so far.
Public exploit code 12
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
- High 7.5 EPSS 66%
-
Unscored
CVE-2018-0966 Public exploit A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affe…EPSS 2.3%
-
Unscored
CVE-2018-0968 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 3.6%
-
Unscored
CVE-2018-0969 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 3.4%
-
Unscored
CVE-2018-0970 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 3.4%
-
Unscored
CVE-2018-0971 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 3.4%
-
Unscored
CVE-2018-0972 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 3.4%
-
Unscored
CVE-2018-0973 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 3.4%
-
Unscored
CVE-2018-0974 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 3.4%
-
Unscored
CVE-2018-0975 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 2.9%
-
Unscored
CVE-2018-1010 Public exploit A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote …EPSS 40%
-
Unscored
CVE-2018-1026 Public exploit A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office R…EPSS 41%
All vulnerabilities 65
High7 ShowHide
- High 7.5 EPSS 66%
- High 7.5 EPSS 15%
- High 7.5 EPSS 15%
- High 7.5 EPSS 15%
- High 7.5 EPSS 15%
- High 7.5 EPSS 15%
- High 7.5 EPSS 15%
Unscored58 ShowHide
-
Unscored
CVE-2018-0966 Public exploit A security feature bypass exists when Device Guard incorrectly validates an untrusted file, aka "Device Guard Security Feature Bypass Vulnerability." This affe…EPSS 2.3%
-
Unscored
CVE-2018-0968 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 3.6%
-
Unscored
CVE-2018-0969 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 3.4%
-
Unscored
CVE-2018-0970 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 3.4%
-
Unscored
CVE-2018-0971 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 3.4%
-
Unscored
CVE-2018-0972 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 3.4%
-
Unscored
CVE-2018-0973 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 3.4%
-
Unscored
CVE-2018-0974 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 3.4%
-
Unscored
CVE-2018-0975 Public exploit An information disclosure vulnerability exists in the Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address S…EPSS 2.9%
-
Unscored
CVE-2018-1010 Public exploit A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote …EPSS 40%
-
Unscored
CVE-2018-1026 Public exploit A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office R…EPSS 41%
-
Unscored
CVE-2018-0870 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili…EPSS 15%
-
Unscored
CVE-2018-0887 An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka "Windows Kernel Information Disclosur…EPSS 1.8%
-
Unscored
CVE-2018-0890 A security feature bypass vulnerability exists when Active Directory incorrectly applies Network Isolation settings, aka "Active Directory Security Feature Byp…EPSS 4.2%
-
Unscored
CVE-2018-0892 An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerabili…EPSS 5.3%
-
Unscored
CVE-2018-0920 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem…EPSS 21%
-
Unscored
CVE-2018-0950 An information disclosure vulnerability exists when Office renders Rich Text Format (RTF) email messages containing OLE objects when a message is opened or pre…EPSS 8.9%
-
Unscored
CVE-2018-0956 A denial of service vulnerability exists in the HTTP 2.0 protocol stack (HTTP.sys) when HTTP.sys improperly parses specially crafted HTTP 2.0 requests, aka "HT…EPSS 14%
-
Unscored
CVE-2018-0957 An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a…EPSS 1.6%
-
Unscored
CVE-2018-0960 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 1.8%
-
Unscored
CVE-2018-0963 An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka "Windows Kernel Elevation of Privilege Vulnera…EPSS 1.2%
-
Unscored
CVE-2018-0964 An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a…EPSS 1.6%
-
Unscored
CVE-2018-0967 A denial of service vulnerability exists in the way that Windows SNMP Service handles malformed SNMP traps, aka "Windows SNMP Service Denial of Service Vulnera…EPSS 18%
-
Unscored
CVE-2018-0976 A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted …EPSS 4.7%
-
Unscored
CVE-2018-0981 An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Infor…EPSS 6.4%
-
Unscored
CVE-2018-0987 An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Internet Explorer, aka "Scripting Engine…EPSS 6.1%
-
Unscored
CVE-2018-0988 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 15%
-
Unscored
CVE-2018-0989 An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Infor…EPSS 5.3%
-
Unscored
CVE-2018-0991 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili…EPSS 15%
-
Unscored
CVE-2018-0996 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 15%
-
Unscored
CVE-2018-0997 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili…EPSS 15%
-
Unscored
CVE-2018-0998 An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka "Microsoft Edge Information Disclosure …EPSS 5.6%
-
Unscored
CVE-2018-1000 An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Infor…EPSS 7.5%
-
Unscored
CVE-2018-1001 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 15%
-
Unscored
CVE-2018-1003 A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, aka "Microsoft JET Da…EPSS 23%
-
Unscored
CVE-2018-1004 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution …EPSS 19%
-
Unscored
CVE-2018-1005 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share…EPSS 2.2%
-
Unscored
CVE-2018-1007 An information disclosure vulnerability exists when Microsoft Office improperly discloses the contents of its memory, aka "Microsoft Office Information Disclos…EPSS 6.5%
-
Unscored
CVE-2018-1008 An elevation of privilege vulnerability exists in Windows Adobe Type Manager Font Driver (ATMFD.dll) when it fails to properly handle objects in memory, aka "O…EPSS 1.1%
-
Unscored
CVE-2018-1009 An elevation of privilege vulnerability exists when Windows improperly handles objects in memory and incorrectly maps kernel memory, aka "Microsoft DirectX Gra…EPSS 1.2%
-
Unscored
CVE-2018-1011 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem…EPSS 20%
-
Unscored
CVE-2018-1012 A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote …EPSS 23%
-
Unscored
CVE-2018-1013 A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote …EPSS 23%
-
Unscored
CVE-2018-1014 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share…EPSS 2.2%
-
Unscored
CVE-2018-1015 A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote …EPSS 23%
-
Unscored
CVE-2018-1016 A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Microsoft Graphics Remote …EPSS 23%
-
Unscored
CVE-2018-1018 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili…EPSS 15%
-
Unscored
CVE-2018-1020 A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili…EPSS 17%
-
Unscored
CVE-2018-1023 A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory Corruption Vulnerabilit…EPSS 15%
-
Unscored
CVE-2018-1027 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem…EPSS 19%
-
Unscored
CVE-2018-1028 A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts, aka "Microsoft Office Grap…EPSS 19%
-
Unscored
CVE-2018-1029 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem…EPSS 21%
-
Unscored
CVE-2018-1030 A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka "Microsoft Office R…EPSS 24%
-
Unscored
CVE-2018-1032 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share…EPSS 2.2%
-
Unscored
CVE-2018-1034 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected Share…EPSS 2.2%
-
Unscored
CVE-2018-1037 An information disclosure vulnerability exists when Visual Studio improperly discloses limited contents of uninitialized memory while compiling program databas…EPSS 5.8%
-
Unscored
CVE-2018-8116 A denial of service vulnerability exists in the way that Windows handles objects in memory, aka "Microsoft Graphics Component Denial of Service Vulnerability."…EPSS 1.4%
-
Unscored
CVE-2018-8117 A security feature bypass vulnerability exists in the Microsoft Wireless Keyboard 850 which could allow an attacker to reuse an AES encryption key to send keys…EPSS 1.2%