CVE-2018-0821

CVE-2018-0821 is a local elevation-of-privilege vulnerability in Windows AppContainer affecting Windows 10 (Gold, 1511, 1607, 1703, 1709) and Windows Server (2016 and 1709) where constrained impersonations are mishandled. The root cause is how AppContainer constrains impersonations, enabling a lo...

CVE-2018-0756

The Windows kernel in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege vulnerability due to the way objects are handled in memory, aka "Windows Kernel Elevation of Privilege Vulnerability". This CVE is unique from...

CVE-2018-0835

Mode C: The connected advisories describe a ChakraCore/Edge remote code execution vulnerability caused by the scripting engine’s handling of in-memory objects (Scripting Engine Memory Corruption Vulnerability). Affected software includes Microsoft Edge and ChakraCore on Windows 10 releases such a...

CVE-2018-0742

Technical details (affected product/versions/root cause/fix) are not publicly available in the provided documents. Monitor for updates from trusted sources.

CVE-2018-0840

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Internet Explorer and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting...

CVE-2018-0847

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow information disclosure, due to how Internet Explorer handles objects in memory, aka...

CVE-2018-0835

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834,...

CVE-2018-0826

CVE-2018-0826 affects Windows Storage Services in Windows 10 (versions 1511, 1607, 1703, 1709) and Windows Server 2016/1709, caused by improper handling of objects in memory, enabling local elevation of privilege. Affected component: Windows Storage Services; root cause: memory object handling le...

CVE-2018-0861

The CVE-2018-0861 entry concerns a memory corruption flaw in the scripting engine used by Microsoft Edge and ChakraCore, leading to remote code execution. Affected software/products mentioned across connected documents include Microsoft Edge and ChakraCore on Windows 10 (Gold/1511/1607/1703/1709)...

CVE-2018-0834

Summary: Multiple CVEs describe a remote code execution vulnerability in Microsoft Edge and ChakraCore caused by memory handling in the Chakra scripting engine (“Scripting Engine Memory Corruption Vulnerability”). The connected advisories (GHSA entries) denote ChakraCore RCE affecting Windows 10 ...

CVE-2018-0831

The CVE-2018-0831 entry IDs a Windows kernel elevation-of-privilege vulnerability affecting Windows 10 (versions 1607, 1703, 1709) and Windows Server 2016/1709. The flaw arises from how memory-object handling in the Windows kernel can be exploited by a locally authenticated attacker to run arbitr...

EUVD-2018-1655

The Microsoft Windows Embedded OpenType EOT font engine in Microsoft Windows 7 SP1 and Windows Server 2008 R2 allows information disclosure, due to how the Windows EOT font engine handles embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability". This CVE ID is unique fro...

CVE-2018-0842

Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allow an elevation of privilege vulnerability due to how objects in memory are handled, aka...

CVE-2018-0825

StructuredQuery in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows a remote code execution vulnerability due to how objects are handled in...

Security Updates for Windows Server 2008 (February 2018)

The remote Windows host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain...

Update to add SHA-2 code signing support for Windows Server 2008 SP2

Update to add SHA-2 code signing support for Windows Server 2008 SP2 Summary This update provides support for the Secure Hash Algorithm-2 SHA-2 code signing and verification functionality in the 64-bit version of Windows Server 2008 Service Pack 2 SP2 which includes the following: Support for...

Microsoft Windows Embedded OpenType Font Engine Information Disclosure Vulnerability (CNVD-2018-03526)

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the U.S. The Windows Embedded OpenType EOT font engine is one of the font engines. An information disclosure vulnerability exists in the Windows EOT font engine in Microsoft Windows 7 SP1 and Windows Server 20...

Microsoft Embedded OpenType Font Engine Information Disclosure Vulnerability

Microsoft Windows 7 and Windows Server 2008 are both products of Microsoft Corporation. The former is an operating system for personal computers and the latter is a server operating system.Windows Embedded OpenType EOT font engine is one of the font engines. An information disclosure vulnerabilit...

Update to add SHA-2 authentication endpoint support for WSUS in Windows Server 2008 SP2

Update to add SHA-2 authentication endpoint support for WSUS in Windows Server 2008 SP2 Summary This update provides support of the Secure Hash Algorithm-2 SHA-2 server authentication endpoint for Windows Server Update Services WSUS in Windows Server 2008 Service Pack 2 SP2. How to get this updat...

Microsoft Windows Embedded OpenType Font Engine Information Disclosure Vulnerability (CNVD-2018-03527)

Microsoft Windows is a series of operating systems released by Microsoft Corporation in the U.S. The Windows Embedded OpenType EOT font engine is one of the font engines. An information disclosure vulnerability exists in the Windows EOT font engine in Microsoft Windows 7 SP1, Windows Server 2008...