| Description: | Summary:
This host is missing a critical security
update according to Microsoft KB4093118
Vulnerability Insight:
Multiple flaws exist due to:
- When the Windows font library improperly handles specially crafted embedded
fonts.
- When Internet Explorer improperly accesses objects in memory.
- When the Windows kernel fails to properly initialize a memory address.
- When the scripting engine does not properly handle objects in memory in
Internet Explorer.
- In Windows Adobe Type Manager Font Driver (ATMFD.
- In the Windows kernel that could allow an attacker to retrieve information
that could lead to a Kernel Address Space Layout Randomization (ASLR) bypass.
- In the way that Windows SNMP Service handles malformed SNMP traps.
- When the Windows kernel improperly handles objects in memory.
- In the way that the VBScript engine handles objects in memory.
- In the way that Windows handles objects in memory.
- In Remote Desktop Protocol (RDP) when an attacker connects to the target
system using RDP and sends specially crafted requests.
- In the Microsoft JET Database Engine that could allow remote code execution on
an affected system.
Vulnerability Impact:
Successful exploitation will allow an attacker
to take control of the affected system, obtain information to further compromise
the user's system, execute arbitrary code, retrieve the memory address of a
kernel object, cause a target system to stop responding.
Affected Software/OS:
- Microsoft Windows 7 for 32-bit/x64 Systems Service Pack 1
- Microsoft Windows Server 2008 R2 for x64-based Systems Service Pack 1
Solution:
The vendor has released updates. Please see the references for more information.
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
