Microsoft Patch Tuesday — December 2019
Tuesday, 10 December 2019
- Vulnerabilities
- 30
- Critical
- 0
- High
- 1
- Zero-days
- 0
- Public exploit
- 3
Exploited 1
Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.
-
High 7.8
CVE-2019-1458 Exploited Public exploit An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil…EPSS 74%
Public exploit code 2
Not critical and not yet seen exploited, but exploit or proof-of-concept code is public.
-
Unscored
CVE-2019-1476 Public exploit An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privileg…EPSS 5.1%
-
Unscored
CVE-2019-1332 Public exploit A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web reques…EPSS 11%
All vulnerabilities 30
High1 ShowHide
-
High 7.8
CVE-2019-1458 Exploited Public exploit An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privil…EPSS 74%
Unscored29 ShowHide
-
Unscored
CVE-2019-1476 Public exploit An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privileg…EPSS 5.1%
-
Unscored
CVE-2019-1332 Public exploit A cross-site scripting (XSS) vulnerability exists when Microsoft SQL Server Reporting Services (SSRS) does not properly sanitize a specially-crafted web reques…EPSS 11%
-
Unscored
CVE-2019-1400 An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access…EPSS 2.3%
-
Unscored
CVE-2019-1453 A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted …EPSS 9.7%
-
Unscored
CVE-2019-1461 A denial of service vulnerability exists in Microsoft Word software when the software fails to properly handle objects in memory, aka 'Microsoft Word Denial of…EPSS 5%
-
Unscored
CVE-2019-1462 A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory, aka 'Microsoft Powe…EPSS 18%
-
Unscored
CVE-2019-1463 An information disclosure vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory, aka 'Microsoft Access…EPSS 2.3%
-
Unscored
CVE-2019-1464 An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka 'Microsoft Excel Information Disclosur…EPSS 8.7%
-
Unscored
CVE-2019-1465 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis…EPSS 6%
-
Unscored
CVE-2019-1466 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis…EPSS 6%
-
Unscored
CVE-2019-1467 An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Dis…EPSS 6%
-
Unscored
CVE-2019-1468 A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka 'Win32k Graphics Remote Cod…EPSS 18%
-
Unscored
CVE-2019-1469 An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information Disclosure Vulnerabili…EPSS 1.6%
-
Unscored
CVE-2019-1470 An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a…EPSS 6.7%
-
Unscored
CVE-2019-1471 A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest opera…EPSS 8%
-
Unscored
CVE-2019-1472 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera…EPSS 1.6%
-
Unscored
CVE-2019-1474 An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka 'Windows Kernel Information Disclosure Vulnera…EPSS 1.6%
-
Unscored
CVE-2019-1477 An elevation of privilege vulnerability exists when the Windows Printer Service improperly validates file paths while loading printer drivers, aka 'Windows Pri…EPSS 1.1%
- Unscored
-
Unscored
CVE-2019-1480 An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Media Player Informatio…EPSS 6%
-
Unscored
CVE-2019-1481 An information disclosure vulnerability exists in Windows Media Player when it fails to properly handle objects in memory, aka 'Windows Media Player Informatio…EPSS 17%
-
Unscored
CVE-2019-1483 An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerability, an attacker …EPSS 1.9%
-
Unscored
CVE-2019-1484 A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerabi…EPSS 9.5%
-
Unscored
CVE-2019-1485 A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'.EPSS 8.2%
-
Unscored
CVE-2019-1486 A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL specified by the s…EPSS 1.6%
-
Unscored
CVE-2019-1487 An information disclosure vulnerability in Android Apps using Microsoft Authentication Library (MSAL) 0.3.1-Alpha or later exists under specific conditions, ak…EPSS 4.6%
- Unscored
-
Unscored
CVE-2019-1489 An information disclosure vulnerability exists when the Windows Remote Desktop Protocol (RDP) fails to properly handle objects in memory, aka 'Remote Desktop P…EPSS 8.3%
-
Unscored
CVE-2019-1490 A spoofing vulnerability exists when a Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business Server Spoofin…EPSS 1.5%