Multi critical security vulnerabilities were fixed on December Patch Tuesday

by ddos ·

On December 11, 2019, Microsoft and Adobe released the December security update. The types of vulnerabilities addressed include out-of-bounds reads and write, some untrusted pointer references, and some UAFs. No vulnerabilities have been announced at the time of publication, or reports of active attacks have been received.

This security update from Adobe covers Acrobat Reader, Bracket, Cold Fusion, Photoshop. This security update from Microsoft mainly covers the Windows operating system, IE / Edge browser, Hyper-V Server, Microsoft Defender, Github Library, Office Services, and SQL Server. A total of 36 CVEs, 28 high-risk vulnerabilities, and 8 medium-risk vulnerabilities. Among them, a privilege elevation vulnerability of CVE-2019-1458 Win32k has been marked as exploitable by Microsoft and has been exploited in the wild.

Windows zero day flaws

Brackets Remote Code Execution Vulnerability

CVE-2019-8255, Adobe number APSB19-57, fixes the Brackets remote code execution vulnerability. This component can run cross-platform on Windows, MacOS, Linux. The affected versions are 1.14 and earlier.

Win32k Privilege Escalation Vulnerability

CVE-2019-1458 According to Kaspersky Labs, the vulnerability was classified as a vulnerability with an active field attack this month. There are some speculations that this vulnerability, combined with Chrome’s UAF vulnerability, could lead to a Chrome sandbox escape.

Hyper-V Server Remote Code Execution Vulnerability

CVE-2019-1471 This vulnerability allows arbitrary code execution on a Hyper-V Server host inside a virtualization host. This is a loophole that is worthy of attention because, in the current era of virtualization technology, it is very influential.

Win32k Graphics remote code execution

CVE-2019-1468 still finds serious problems with embedded fonts. If an attacker looks at a specially crafted font, it could cause the attacker to execute code on the affected system. If logged in as an administrator, an attacker could take over the system completely.

Git for Visual Studio remote code execution vulnerability

  • CVE-2019-1349 Remote Code Execution Vulnerability
  • CVE-2019-1350 remote code execution vulnerability
  • CVE-2019-1352 Remote Code Execution Vulnerability
  • CVE-2019-1354 Remote Code Execution Vulnerability
  • CVE-2019-1387 remote code execution vulnerability

Developers using VS need to pay attention to multiple remote code executions caused by the GIT embedded in Visual Studio.

Tags: December Patch Tuesday