The vulnerability of the Microsoft Exchange Server mail server arises from a transaction that occurs outside the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Exchange Server arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code with SYSTEM-level privileges by sending a specially crafted email to the...

Update Rollup 22 for Exchange Server 2010 Service Pack 3

Update Rollup 22 for Exchange Server 2010 Service Pack 3 Update Rollup 22 for Microsoft Exchange Server 2010 Service Pack 3 SP3 was released on June 19, 2018. Before you install this update, you must remove all interim updates for Exchange Server 2010 SP3. Also, see this important information abo...

June 2018 Oracle Outside In Library Security Update

Microsoft Exchange Server contains some elements of the Oracle Outside In libraries. The June 19, 2018 releases of Microsoft Exchange Server contain fixes to the following vulnerabilities, which are described in: Oracle Critical Patch Update Advisory - April 2018: CVE-2018-2768, CVE-2018-2806,...

Security update 2018-06-19

...

Cumulative Update 10 for Exchange Server 2016

None None...

KLA11269 Multiple vulnerabilities in Microsoft Exchange Server

Multiple serious vulnerabilities have been found in Microsoft Exchange Server. Malicious users can exploit these vulnerabilities to cause denial of service or obtain sensitive data. These vulnerabilities are related to Oracle Outside In libraries elements and can be exploited by unauthenticated...

Security Bulletin: Vulnerability in InstallShield affects IBM Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server (CVE-2016-2542)

Summary InstallShield generates installation executables which are vulnerable to a DLL-planting that affects IBM Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server IBM Spectrum Protect for Mail on Windows platforms. Vulnerability Details CVEID: CVE-2016-2542 DESCRIPTIO...

Security Bulletin: Additional Password Disclosure via application tracing in FlashCopy Manager on Windows, Data Protection for Exchange, and Data Protection for SQL CVE-2015-7404

Summary The Tivoli Storage Manager TSM password is displayed in plain text via application trace output when the "Change TSM Password" changetsmpassword command is used and application tracing is enabled. Vulnerability Details CVEID: CVE-2015-7404 DESCRIPTION: When using one of the following...

CVE-2018-8159

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access OWA fails to properly handle web requests, aka "Microsoft Exchange Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server...

CVE-2018-8159

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access OWA fails to properly handle web requests, aka "Microsoft Exchange Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server...

CVE-2018-8152

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access OWA fails to properly handle web requests, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server...

CVE-2018-8154

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server. This CVE ID is unique from CVE-2018-8151...

CVE-2018-8151

An information disclosure vulnerability exists when Microsoft Exchange improperly handles objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server. This CVE ID is unique from CVE-2018-8154...

CVE-2018-8153

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access OWA fails to properly handle web requests, aka "Microsoft Exchange Spoofing Vulnerability." This affects Microsoft Exchange Server...

CVE-2018-8154

CVE-2018-8154 is a remote code execution vulnerability in Microsoft Exchange Server caused by improper handling of objects in memory. The issue enables an attacker to run arbitrary code in the context of the System user, typically via a specially crafted email. Public material in the connected do...

CVE-2018-8152

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access OWA fails to properly handle web requests, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server...

Microsoft Patches Two Zero-Day Flaws Under Active Attack

It's time to gear up for the latest May 2018 Patch Tuesday. Microsoft has today released security patches for a total of 67 vulnerabilities, including two zero-days that have actively been exploited in the wild by cybercriminals, and two publicly disclosed bugs. In brief, Microsoft is addressing ...

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Exchange Server is a set of e-mail service programs from Microsoft, which provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A spoofing vulnerability exists in Microsoft Exchange Server 2016 Cumulative Update 8 and 9, which stems from Outlook Web...

Microsoft Exchange Server Information Disclosure Vulnerability (CNVD-2018-10741)

Microsoft Exchange Server is a set of e-mail service programs from Microsoft, which provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. An information disclosure vulnerability exists in Microsoft Exchange Server that stems from Exchange failing to properly...

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Exchange Server is a set of e-mail service programs from Microsoft, which provides e-mail access, storage, forwarding, voice mail, e-mail filtering and screening. A privilege-lifting vulnerability exists in Microsoft Exchange Server 2016 Cumulative Update versions 8 and 9, which stems...