Microsoft Patch Tuesday — December 2018
Tuesday, 11 December 2018
- Vulnerabilities
- 39
- Critical
- 0
- High
- 7
- Zero-days
- 0
- Public exploit
- 7
Exploited 2
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
High 8.4
CVE-2018-8639 Exploited Public exploit An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil…EPSS 22%
-
High 7.8
CVE-2018-8611 Exploited Public exploit An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege V…EPSS 4.2%
Public exploit code 5
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
- High 7.5 EPSS 62%
-
Unscored
CVE-2018-8619 Public exploit A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions…EPSS 45%
-
Unscored
CVE-2018-8625 Public exploit A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution …EPSS 44%
-
Unscored
CVE-2018-8631 Public exploit A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili…EPSS 68%
-
Unscored
CVE-2018-8587 Public exploit A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Co…EPSS 29%
All vulnerabilities 39
High7 ShowHide
-
High 8.4
CVE-2018-8639 Exploited Public exploit An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privil…EPSS 22%
-
High 7.8
CVE-2018-8611 Exploited Public exploit An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of Privilege V…EPSS 4.2%
- High 7.5 EPSS 62%
- High 7.5 EPSS 11%
- High 7.5 EPSS 11%
- High 7.5 EPSS 13%
- High 7.5 EPSS 23%
Medium1 ShowHide
Unscored31 ShowHide
-
Unscored
CVE-2018-8619 Public exploit A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions…EPSS 45%
-
Unscored
CVE-2018-8625 Public exploit A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution …EPSS 44%
-
Unscored
CVE-2018-8631 Public exploit A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerabili…EPSS 68%
-
Unscored
CVE-2018-8587 Public exploit A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory, aka "Microsoft Outlook Remote Co…EPSS 29%
-
Unscored
CVE-2018-8477 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 1.8%
-
Unscored
CVE-2018-8514 An information disclosure vulnerability exists when Remote Procedure Call runtime improperly initializes objects in memory, aka "Remote Procedure Call runtime …EPSS 1.9%
-
Unscored
CVE-2018-8517 A denial of service vulnerability exists when .NET Framework improperly handles special web requests, aka ".NET Framework Denial Of Service Vulnerability." Thi…EPSS 5.7%
-
Unscored
CVE-2018-8540 A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vuln…EPSS 22%
-
Unscored
CVE-2018-8580 An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search at…EPSS 4.4%
-
Unscored
CVE-2018-8595 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis…EPSS 6.9%
-
Unscored
CVE-2018-8596 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka "Windows GDI Information Dis…EPSS 7.1%
-
Unscored
CVE-2018-8597 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem…EPSS 16%
-
Unscored
CVE-2018-8598 An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosur…EPSS 6.2%
- Unscored
-
Unscored
CVE-2018-8604 A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tampering Vulnerability."…EPSS 2.4%
-
Unscored
CVE-2018-8612 A Denial Of Service vulnerability exists when Connected User Experiences and Telemetry Service fails to validate certain function values, aka "Connected User E…EPSS 1.4%
-
Unscored
CVE-2018-8621 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 1.8%
-
Unscored
CVE-2018-8622 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information Disclosure Vulnera…EPSS 1.8%
-
Unscored
CVE-2018-8626 A remote code execution vulnerability exists in Windows Domain Name System (DNS) servers when they fail to properly handle requests, aka "Windows DNS Server He…EPSS 21%
-
Unscored
CVE-2018-8627 An information disclosure vulnerability exists when Microsoft Excel software reads out of bound memory due to an uninitialized variable, which could disclose t…EPSS 8.6%
-
Unscored
CVE-2018-8628 A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka "Microsoft Powe…EPSS 16%
-
Unscored
CVE-2018-8634 A remote code execution vulnerability exists in Windows where Microsoft text-to-speech fails to properly handle objects in the memory, aka "Microsoft Text-To-S…EPSS 15%
-
Unscored
CVE-2018-8635 An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted authentication request to an aff…EPSS 6.1%
-
Unscored
CVE-2018-8636 A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka "Microsoft Excel Rem…EPSS 16%
-
Unscored
CVE-2018-8637 An information disclosure vulnerability exists in Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space…EPSS 1.8%
-
Unscored
CVE-2018-8638 An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka "DirectX Information Disclosure Vulnerability." This affe…EPSS 1.8%
-
Unscored
CVE-2018-8641 An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka "Win32k Elevation…EPSS 1.1%
-
Unscored
CVE-2018-8643 A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory …EPSS 9.9%
-
Unscored
CVE-2018-8649 A denial of service vulnerability exists when Windows improperly handles objects in memory, aka "Windows Denial of Service Vulnerability." This affects Windows…EPSS 1.7%
-
Unscored
CVE-2018-8651 A cross site scripting vulnerability exists when Microsoft Dynamics NAV does not properly sanitize a specially crafted web request to an affected Dynamics NAV …EPSS 1.5%
-
Unscored
CVE-2018-8652 A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input, aka "Windows Azure Pack Cross Site Sc…EPSS 1.5%