Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA11555
HistorySep 10, 2019 - 12:00 a.m.

KLA11555 Multiple vulnerabilities in Microsoft Products (ESU)

2019-09-1000:00:00
Kaspersky Lab
threats.kaspersky.com
24

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.308 Low

EPSS

Percentile

96.9%

JSON

Detect date:

09/10/2019

Severity:

Critical

Description:

Multiple vulnerabilities were found in Microsoft Products (Extended Support Update). Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, obtain sensitive information, bypass security restrictions.

Exploitation:

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Affected products:

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows 10 for 32-bit Systems
Windows Server, version 1803 (Server Core Installation)
Windows 10 Version 1903 for x64-based Systems
Internet Explorer 9
Microsoft Office 2019 for 64-bit editions
Windows 10 for x64-based Systems
Windows Server 2012 (Server Core installation)
Windows Server 2016 (Server Core installation)
Windows 7 for x64-based Systems Service Pack 1
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2012
Office 365 ProPlus for 64-bit Systems
Microsoft Office 2010 Service Pack 2 (32-bit editions)
Microsoft Office 2013 RT Service Pack 1
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Internet Explorer 11
Microsoft Office 2010 Service Pack 2 (64-bit editions)
Windows 10 Version 1803 for ARM64-based Systems
Windows Server 2008 for x64-based Systems Service Pack 2
Office 365 ProPlus for 32-bit Systems
Windows Server 2016
Windows 10 Version 1709 for x64-based Systems
Windows RT 8.1
Windows 10 Version 1709 for ARM64-based Systems
Windows 10 Version 1703 for x64-based Systems
Windows 10 Version 1809 for 32-bit Systems
Windows Server 2008 for Itanium-Based Systems Service Pack 2
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1903 for 32-bit Systems
Windows Server 2012 R2 (Server Core installation)
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Windows Server 2019 (Server Core installation)
Microsoft Edge (EdgeHTML-based)
Microsoft Office 2016 (32-bit edition)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows 10 Version 1803 for x64-based Systems
Microsoft Office 2019 for 32-bit editions
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Windows Server, version 1903 (Server Core installation)
Windows 10 Version 1903 for ARM64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1809 for x64-based Systems
Windows Server, version 1709 (Server Core Installation)
Microsoft Office 2016 (64-bit edition)
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 1803 for 32-bit Systems
Windows 7 for 32-bit Systems Service Pack 1
Internet Explorer 10
Windows 10 Version 1709 for 32-bit Systems
Windows 10 Version 1703 for 32-bit Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2012 R2
Windows Server 2019

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2019-1236
CVE-2019-1235
CVE-2019-1215
CVE-2019-1214
CVE-2019-1216
CVE-2019-1219
CVE-2019-1271
CVE-2019-1256
CVE-2019-1250
CVE-2019-1274
CVE-2019-1242
CVE-2019-1282
CVE-2019-1283
CVE-2019-1280
CVE-2019-1252
CVE-2019-1286
CVE-2019-1284
CVE-2019-1285
CVE-2019-0787
CVE-2019-1220
CVE-2019-1291
CVE-2019-1267
CVE-2019-1248
CVE-2019-1249
CVE-2019-1246
CVE-2019-1247
CVE-2019-1244
CVE-2019-1245
CVE-2019-1268
CVE-2019-1243
CVE-2019-1240
CVE-2019-1241
CVE-2019-1208
CVE-2019-1290
CVE-2019-1293

Impacts:

ACE

Related products:

Microsoft Internet Explorer

CVE-IDS:

CVE-2019-12469.3Critical
CVE-2019-12157.2High
CVE-2019-12509.3Critical
CVE-2019-12932.1Warning
CVE-2019-12499.3Critical
CVE-2019-12429.3Critical
CVE-2019-12864.3Warning
CVE-2019-12409.3Critical
CVE-2019-12524.3Warning
CVE-2019-12919.3Critical
CVE-2019-12162.1Warning
CVE-2019-12567.2High
CVE-2019-12489.3Critical
CVE-2019-12717.2High
CVE-2019-07879.3Critical
CVE-2019-12419.3Critical
CVE-2019-12479.3Critical
CVE-2019-12909.3Critical
CVE-2019-12444.3Warning
CVE-2019-12677.2High
CVE-2019-12809.3Critical
CVE-2019-12687.2High
CVE-2019-12857.2High
CVE-2019-12847.2High
CVE-2019-12192.1Warning
CVE-2019-12147.2High
CVE-2019-12439.3Critical
CVE-2019-12822.1Warning
CVE-2019-12832.1Warning
CVE-2019-12742.1Warning
CVE-2019-12357.2High
CVE-2019-12454.3Warning
CVE-2019-12204.3Warning
CVE-2019-12367.6Critical
CVE-2019-12087.6Critical

Microsoft official advisories:

KB list:

4516051
4516065
4516026
4516033
4516046

References

Related

nessus 12
mskb 19
openvas 13
prion 32
cve 34
kaspersky 1
thn 1
threatpost 1
krebs 1
talosblog 1
qualysblog 1
checkpoint_advisories 8
mscve 30
zdi 9
symantec 31
zdt 3
trendmicroblog 1
cisa_kev 1
nessus
nessus
KB4516051: Windows Server 2008 September 2019 Security Update
2019-09-10 00:00:00
KB4516033: Windows 7 and Windows Server 2008 R2 September 2019 Security Update
2019-09-10 00:00:00
KB4516062: Windows Server 2012 September 2019 Security Update
2019-09-10 00:00:00
mskb
mskb
September 10, 2019—KB4516033 (Security-only update)
2019-11-12 08:00:00
September 10, 2019—KB4516026 (Monthly Rollup)
2019-09-10 07:00:00
September 10, 2019—KB4516065 (Monthly Rollup)
2019-11-12 08:00:00
openvas
openvas
Microsoft Windows Multiple Vulnerabilities (KB4516065)
2019-09-11 00:00:00
Microsoft Windows Multiple Vulnerabilities (KB4516026)
2019-09-11 00:00:00
Microsoft Windows Multiple Vulnerabilities (KB4516067)
2019-09-11 00:00:00
prion
prion
Remote code execution
2019-09-11 22:15:00
Remote code execution
2019-09-11 22:15:00
Remote code execution
2019-09-11 22:15:00
cve
cve
CVE-2019-1248
2019-09-11 22:15:00
CVE-2019-1241
2019-09-11 22:15:00
CVE-2019-1249
2019-09-11 22:15:00
kaspersky
kaspersky
KLA11552 Multiple vulnerabilities in Microsoft Windows
2019-09-10 00:00:00
thn
thn
Latest Microsoft Updates Patch 4 Critical Flaws In Windows RDP Client
2019-09-10 18:16:00
threatpost
threatpost
Microsoft Addresses Two Zero-Days Under Active Attack
2019-09-10 19:54:07
krebs
krebs
Patch Tuesday, September 2019 Edition
2019-09-10 20:09:11
talosblog
talosblog
Microsoft Patch Tuesday — Sept. 2019: Vulnerability disclosures and Snort coverage
2019-09-10 12:12:34
qualysblog
qualysblog
September Patch Tuesday – 79 Vulns, 17 Critical, Remote Desktop Client, SharePoint, Exploited PrivEsc
2019-09-10 18:00:37
checkpoint_advisories
checkpoint_advisories
Microsoft Win32k Elevation of Privilege (CVE-2019-1256)
2019-09-10 00:00:00
Microsoft DirectX Elevation of Privilege (CVE-2019-1284)
2019-09-10 00:00:00
VBScript Engine Remote Code Execution (CVE-2019-1208)
2019-09-15 00:00:00
mscve
mscve
DirectWrite Information Disclosure Vulnerability
2019-09-10 07:00:00
Jet Database Engine Remote Code Execution Vulnerability
2019-09-10 07:00:00
Win32k Elevation of Privilege Vulnerability
2019-09-10 07:00:00
zdi
zdi
Microsoft Windows JET Database Engine Integer Underflow Remote Code Execution Vulnerability
2019-09-10 00:00:00
Microsoft Windows JET Database Engine Out-Of-Bounds Read Remote Code Execution Vulnerability
2019-09-10 00:00:00
Microsoft Windows VBScript Array Use-After-Free Remote Code Execution Vulnerability
2019-09-12 00:00:00
symantec
symantec
Microsoft Windows JET Database Engine CVE-2019-1243 Remote Code Execution Vulnerability
2019-09-10 00:00:00
Microsoft Windows DirectX CVE-2019-1284 Local Privilege Escalation Vulnerability
2019-09-10 00:00:00
Microsoft Windows JET Database Engine CVE-2019-1242 Remote Code Execution Vulnerability
2019-09-10 00:00:00
zdt
zdt
Microsoft DirectWrite - Out-of-Bounds Read in sfac_GetSbitBitmap While Processing TTF Fonts Exploit
2019-09-12 00:00:00
Microsoft DirectWrite - Invalid Read in SplicePixel While Processing OTF Fonts Exploit
2019-09-12 00:00:00
Microsoft Windows 10 (19H1 1901 x64) - ws2ifsl.sys Use After Free Local Privilege Escalation Exploit
2020-01-16 00:00:00
trendmicroblog
trendmicroblog
This Week in Security News: IoT Devices Are a Target in Cybercriminal Underground
2019-09-13 13:18:33
cisa_kev
cisa_kev
Microsoft Windows Privilege Escalation Vulnerability
2021-11-03 00:00:00

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.308 Low

EPSS

Percentile

96.9%

JSON
Related for KLA11555
nessus12mskb19openvas13prion32cve34kaspersky1thn1threatpost1krebs1talosblog1qualysblog1checkpoint_advisories8mscve30zdi9symantec31zdt3trendmicroblog1cisa_kev1