May 2017 Security Updates
Security Update
secure@microsoft.com
The Microsoft Security Response Center (MSRC) identifies, monitors, resolves, and responds to security incidents and Microsoft software security vulnerabilities. For more information, see http://www.microsoft.com/security/msrc.
2017-May
2017-May
Final
1.0
13
2026-04-30T01:51:04
May 2017 Security Updates
2017-05-09T07:00:00Z
2026-04-30T01:51:04
<p>The May security release consists of security updates for the following software:</p>
<ul>
<li>Internet Explorer</li>
<li>Microsoft Edge</li>
<li>Microsoft Windows</li>
<li>NET Framework</li>
<li>Adobe Flash Player</li>
<li>Microsoft Office and Microsoft Office Services and Web Apps</li>
<li>Microsoft Malware Protection Engine</li>
</ul>
<p>In addition, Microsoft is releasing security updates for ASP.NET Core to address <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0247">CVE-2017-0247</a>, <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0249">CVE-2017-0249</a>, and <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0256">CVE-2017-0256</a>, and for .NET Core to address <a href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0248">CVE-2017-024</a>8. For more information see https://github.com/aspnet/Announcements/issues/239.</p>
<p>Please note the following information regarding the security updates:</p>
<ul>
<li>Beginning with the October 2016 release, Microsoft is changing the update servicing model for Windows 7, Windows Server 2008 R2, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2. For more information, please see this Microsoft Technet article, <a href="https://blogs.technet.microsoft.com/windowsitpro/2016/08/15/further-simplifying-servicing-model-for-windows-7-and-windows-8-1/">Further simplifying servicing models forWindows 7 and Windows 8.1</a>.</li>
<li>Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are available via the <a href="http://catalog.update.microsoft.com/v7/site/Home.aspx">Microsoft Update Catalog</a>.</li>
<li>Starting in March 2017, a delta package will be available on the Microsoft Update Catalog for Windows 10 version 1607 and newer. This delta package contains just the delta changes between the previous month and the current release.</li>
<li>Updates for Windows RT 8.1 and Microsoft Office RT software are only available via <a href="http://go.microsoft.com/fwlink/?LinkId=21130">Windows Update</a>.</li>
<li>In addition to security changes for the vulnerabilities, updates include defense-in-depth updates to help improve security-related features</li>
</ul>
<p><strong>Note</strong> As a reminder, the <a href="https://portal.msrc.microsoft.com/en-us/security-guidance">Security Update Guide</a> will be replacing security bulletins. Please see our blog post, <a href="https://blogs.technet.microsoft.com/msrc/2016/11/08/furthering-our-commitment-to-security-updates/">Furthering our commitment to security updates</a>, for more details.</p>
The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 Version 1511 for 32-bit Systems
Windows 10 Version 1511 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows RT 8.1
Windows Server 2012
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)
Windows 10 Version 1703 for 32-bit Systems
Windows 10 Version 1703 for x64-based Systems
Windows Server 2016
Windows Server 2016 (Server Core installation)
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for Itanium-Based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Internet Explorer 9 on Windows Server 2008 for 32-bit Systems Service Pack 2
Internet Explorer 9 on Windows Server 2008 for x64-based Systems Service Pack 2
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1703 for 32-bit Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1703 for x64-based Systems
Internet Explorer 11 on Windows Server 2016
Internet Explorer 11 on Windows 10 Version 1703 for 32-bit Systems
Internet Explorer 11 on Windows 10 Version 1703 for x64-based Systems
Internet Explorer 10 on Windows Server 2012
Internet Explorer 11 on Windows 8.1 for 32-bit systems
Internet Explorer 11 on Windows 8.1 for x64-based systems
Internet Explorer 11 on Windows Server 2012 R2
Internet Explorer 11 on Windows RT 8.1
Internet Explorer 11 on Windows 7 for 32-bit Systems Service Pack 1
Internet Explorer 11 on Windows 7 for x64-based Systems Service Pack 1
Internet Explorer 11 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
Internet Explorer 11 on Windows 10 for 32-bit Systems
Internet Explorer 11 on Windows 10 for x64-based Systems
Internet Explorer 11 on Windows 10 Version 1511 for 32-bit Systems
Internet Explorer 11 on Windows 10 Version 1511 for x64-based Systems
Internet Explorer 11 on Windows 10 Version 1607 for 32-bit Systems
Internet Explorer 11 on Windows 10 Version 1607 for x64-based Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for 32-bit Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for x64-based Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 for x64-based Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1511 for 32-bit Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1511 for x64-based Systems
Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2
Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2
Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2
Microsoft .NET Framework 3.5 on Windows Server 2012 (Server Core installation)
Microsoft .NET Framework 3.5 on Windows Server 2012
Microsoft .NET Framework 3.5.1 on Windows 7 for 32-bit Systems Service Pack 1
Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Microsoft .NET Framework 3.5.1 on Windows 7 for x64-based Systems Service Pack 1
Microsoft .NET Framework 4.6.2 on Windows Server 2012 R2
Microsoft .NET Framework 4.6.2 on Windows Server 2012 R2 (Server Core installation)
Microsoft .NET Framework 4.6.2 on Windows Server 2012
Microsoft .NET Framework 4.6.2 on Windows Server 2012 (Server Core installation)
Microsoft .NET Framework 4.6.2 on Windows 8.1 for x64-based systems
Microsoft .NET Framework 4.6.2 on Windows 7 for 32-bit Systems Service Pack 1
Microsoft .NET Framework 4.6.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
Microsoft .NET Framework 4.6.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Microsoft .NET Framework 4.6.2 on Windows 7 for x64-based Systems Service Pack 1
Microsoft .NET Framework 4.6.2 on Windows 8.1 for 32-bit systems
Microsoft .NET Framework 4.6.2 on Windows 10 Version 1607 for 32-bit Systems
Microsoft .NET Framework 4.6.2 on Windows 10 Version 1607 for x64-based Systems
Microsoft .NET Framework 4.6.2 on Windows Server 2016
Microsoft .NET Framework 4.6.2 on Windows Server 2016 (Server Core installation)
Microsoft .NET Framework 3.5 on Windows 8.1 for 32-bit systems
Microsoft .NET Framework 3.5 on Windows 8.1 for x64-based systems
Microsoft .NET Framework 3.5 on Windows Server 2012 R2
Microsoft .NET Framework 3.5 on Windows Server 2012 R2 (Server Core installation)
Microsoft .NET Framework 3.5 on Windows 10 for 32-bit Systems
Microsoft .NET Framework 3.5 on Windows 10 for x64-based Systems
Microsoft .NET Framework 3.5 on Windows 10 Version 1511 for 32-bit Systems
Microsoft .NET Framework 3.5 on Windows 10 Version 1511 for x64-based Systems
Microsoft .NET Framework 3.5 on Windows 10 Version 1607 for 32-bit Systems
Microsoft .NET Framework 3.5 on Windows 10 Version 1607 for x64-based Systems
Microsoft .NET Framework 3.5 on Windows 10 Version 1703 for 32-bit Systems
Microsoft .NET Framework 3.5 on Windows 10 Version 1703 for x64-based Systems
Microsoft .NET Framework 3.5 on Windows Server 2016
Microsoft .NET Framework 3.5 on Windows Server 2016 (Server Core installation)
Microsoft .NET Framework 4.5.2 on Windows Server 2008 for 32-bit Systems Service Pack 2
Microsoft .NET Framework 4.5.2 on Windows Server 2008 for x64-based Systems Service Pack 2
Microsoft .NET Framework 4.5.2 on Windows 7 for 32-bit Systems Service Pack 1
Microsoft .NET Framework 4.5.2 on Windows 7 for x64-based Systems Service Pack 1
Microsoft .NET Framework 4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
Microsoft .NET Framework 4.5.2 on Windows Server 2012
Microsoft .NET Framework 4.5.2 on Windows Server 2012 (Server Core installation)
Microsoft .NET Framework 4.5.2 on Windows 8.1 for 32-bit systems
Microsoft .NET Framework 4.5.2 on Windows 8.1 for x64-based systems
Microsoft .NET Framework 4.5.2 on Windows RT 8.1
Microsoft .NET Framework 4.5.2 on Windows Server 2012 R2
Microsoft .NET Framework 4.5.2 on Windows Server 2012 R2 (Server Core installation)
Microsoft .NET Framework 4.6 on Windows Server 2008 for 32-bit Systems Service Pack 2
Microsoft .NET Framework 4.6 on Windows Server 2008 for x64-based Systems Service Pack 2
Microsoft .NET Framework 4.6 on Windows 10 for 32-bit Systems
Microsoft .NET Framework 4.6 on Windows 10 for x64-based Systems
Microsoft .NET Framework 4.6.1 on Windows 10 Version 1511 for 32-bit Systems
Microsoft .NET Framework 4.6.1 on Windows 10 Version 1511 for x64-based Systems
Microsoft .NET Framework 4.6.2 on Windows RT 8.1
Microsoft .NET Framework 4.6/4.6.1 on Windows 7 for 32-bit Systems Service Pack 1
Microsoft .NET Framework 4.6/4.6.1 on Windows 7 for x64-based Systems Service Pack 1
Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2012
Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2012 (Server Core installation)
Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2012 R2
Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2012 R2 (Server Core installation)
Microsoft .NET Framework 4.6/4.6.1 on Windows 8.1 for 32-bit systems
Microsoft .NET Framework 4.6/4.6.1 on Windows 8.1 for x64-based systems
Microsoft .NET Framework 4.6/4.6.1 on Windows RT 8.1
Microsoft .NET Framework 4.7 on Windows 10 Version 1703 for 32-bit Systems
Microsoft .NET Framework 4.7 on Windows 10 Version 1703 for x64-based Systems
Microsoft Office Word Viewer
Microsoft Word 2007 Service Pack 3
Microsoft Word 2010 Service Pack 2 (32-bit editions)
Microsoft Word 2010 Service Pack 2 (64-bit editions)
Microsoft Word 2013 RT Service Pack 1
Microsoft Word 2013 Service Pack 1 (32-bit editions)
Microsoft Word 2013 Service Pack 1 (64-bit editions)
Microsoft Word 2016 (32-bit edition)
Microsoft Word 2016 (64-bit edition)
Microsoft Office 2010 Service Pack 2 (32-bit editions)
Microsoft Office 2010 Service Pack 2 (64-bit editions)
Microsoft Office 2016 for Mac
Microsoft Office Compatibility Pack Service Pack 3
Microsoft Office for Mac 2011
Microsoft Office Web Apps 2010 Service Pack 2
Microsoft Office Web Apps 2013 Service Pack 1
Microsoft SharePoint Enterprise Server 2016
Word Automation Services on Microsoft SharePoint Server 2013 Service Pack 1
Word Automation Services on Microsoft SharePoint Server 2010 Service Pack 2
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2016 (32-bit edition)
Microsoft Office 2016 (64-bit edition)
Microsoft Office 2013 RT Service Pack 1
Microsoft PowerPoint for Mac 2011
Microsoft Office Online Server 2016
Microsoft Office 2007 Service Pack 3
Microsoft Project Server 2013 Service Pack 1 (64-bit edition)
Microsoft SharePoint Server 2010 Service Pack 2
Skype for Business 2016 (32-bit)
Skype for Business 2016 (64-bit)
Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft Forefront Security for SharePoint Service Pack 3
Microsoft Security Essentials
Windows Intune Endpoint Protection
Microsoft Forefront Endpoint Protection 2010
Windows Defender on Windows 10 Version 1703 for 32-bit Systems
Windows Defender on Windows 10 Version 1703 for x64-based Systems
Windows Defender on Windows 10 for 32-bit Systems
Windows Defender on Windows 10 for x64-based Systems
Windows Defender on Windows 10 Version 1511 for 32-bit Systems
Windows Defender on Windows 10 Version 1511 for x64-based Systems
Windows Defender on Windows 10 Version 1607 for 32-bit Systems
Windows Defender on Windows 10 Version 1607 for x64-based Systems
Windows Defender on Windows Server 2016
Windows Defender on Windows Server 2016 (Server Core installation)
Windows Defender on Windows 7 for 32-bit Systems Service Pack 1
Windows Defender on Windows 7 for x64-based Systems Service Pack 1
Windows Defender on Windows 8.1 for 32-bit systems
Windows Defender on Windows 8.1 for x64-based systems
Windows Defender on Windows RT 8.1
Microsoft Forefront Endpoint Protection
Microsoft Endpoint Protection
Microsoft System Center Endpoint Protection
Windows Defender on Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Windows Defender on Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Defender on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Microsoft Exchange Server 2016
Microsoft Exchange Server 2013
Adobe Flash Player on Windows 8.1 for 32-bit systems
Adobe Flash Player on Windows 8.1 for x64-based systems
Adobe Flash Player on Windows RT 8.1
Adobe Flash Player on Windows Server 2012 R2
Adobe Flash Player on Windows 10 for x64-based Systems
Adobe Flash Player on Windows 10 for 32-bit Systems
Adobe Flash Player on Windows 10 Version 1511 for 32-bit Systems
Adobe Flash Player on Windows 10 Version 1511 for x64-based Systems
Adobe Flash Player on Windows 10 Version 1607 for 32-bit Systems
Adobe Flash Player on Windows 10 Version 1607 for x64-based Systems
Adobe Flash Player on Windows Server 2016
Adobe Flash Player on Windows 10 Version 1703 for 32-bit Systems
Adobe Flash Player on Windows 10 Version 1703 for x64-based Systems
Adobe Flash Player on Windows Server 2012
Microsoft Forefront Security for SharePoint Service Pack 3
Microsoft Security Essentials
Microsoft Office for Mac 2011
Microsoft PowerPoint for Mac 2011
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Microsoft Office 2007 Service Pack 3
Microsoft Word 2007 Service Pack 3
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Microsoft Forefront Endpoint Protection
Windows Intune Endpoint Protection
Internet Explorer 9 on Windows Server 2008 for 32-bit Systems Service Pack 2
Internet Explorer 9 on Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2012
Windows Server 2012 (Server Core installation)
Adobe Flash Player on Windows Server 2012
Adobe Flash Player on Windows 8.1 for 32-bit systems
Adobe Flash Player on Windows 8.1 for x64-based systems
Adobe Flash Player on Windows Server 2012 R2
Adobe Flash Player on Windows RT 8.1
Adobe Flash Player on Windows 10 for 32-bit Systems
Adobe Flash Player on Windows 10 for x64-based Systems
Adobe Flash Player on Windows 10 Version 1511 for x64-based Systems
Adobe Flash Player on Windows 10 Version 1511 for 32-bit Systems
Adobe Flash Player on Windows Server 2016
Adobe Flash Player on Windows 10 Version 1607 for 32-bit Systems
Adobe Flash Player on Windows 10 Version 1607 for x64-based Systems
Adobe Flash Player on Windows 10 Version 1703 for 32-bit Systems
Adobe Flash Player on Windows 10 Version 1703 for x64-based Systems
Microsoft Exchange Server 2013
Windows 8.1 for 32-bit systems
Windows 8.1 for x64-based systems
Windows Server 2012 R2
Windows RT 8.1
Internet Explorer 11 on Windows 7 for 32-bit Systems Service Pack 1
Internet Explorer 11 on Windows 7 for x64-based Systems Service Pack 1
Internet Explorer 11 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
Internet Explorer 11 on Windows 8.1 for 32-bit systems
Internet Explorer 11 on Windows 8.1 for x64-based systems
Internet Explorer 11 on Windows Server 2012 R2
Internet Explorer 11 on Windows RT 8.1
Internet Explorer 11 on Windows 10 for 32-bit Systems
Internet Explorer 11 on Windows 10 for x64-based Systems
Internet Explorer 11 on Windows 10 Version 1511 for x64-based Systems
Internet Explorer 11 on Windows 10 Version 1511 for 32-bit Systems
Internet Explorer 11 on Windows Server 2016
Internet Explorer 11 on Windows 10 Version 1607 for 32-bit Systems
Internet Explorer 11 on Windows 10 Version 1607 for x64-based Systems
Internet Explorer 11 on Windows 10 Version 1703 for 32-bit Systems
Internet Explorer 11 on Windows 10 Version 1703 for x64-based Systems
Microsoft SharePoint Server 2010 Service Pack 2
Microsoft Word 2010 Service Pack 2 (32-bit editions)
Microsoft Word 2010 Service Pack 2 (64-bit editions)
Microsoft Office 2010 Service Pack 2 (32-bit editions)
Microsoft Office 2010 Service Pack 2 (64-bit editions)
Microsoft Office Web Apps 2010 Service Pack 2
Windows Server 2012 R2 (Server Core installation)
Internet Explorer 10 on Windows Server 2012
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft Office 2013 RT Service Pack 1
Microsoft Word 2013 Service Pack 1 (32-bit editions)
Microsoft Word 2013 Service Pack 1 (64-bit editions)
Microsoft Word 2013 RT Service Pack 1
Microsoft Office Web Apps 2013 Service Pack 1
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft Project Server 2013 Service Pack 1 (64-bit edition)
Microsoft .NET Framework 4.5.2 on Windows 7 for 32-bit Systems Service Pack 1
Microsoft .NET Framework 4.5.2 on Windows 7 for x64-based Systems Service Pack 1
Microsoft .NET Framework 4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
Microsoft .NET Framework 4.5.2 on Windows Server 2012
Microsoft .NET Framework 4.5.2 on Windows Server 2012 (Server Core installation)
Microsoft .NET Framework 4.5.2 on Windows 8.1 for 32-bit systems
Microsoft .NET Framework 4.5.2 on Windows 8.1 for x64-based systems
Microsoft .NET Framework 4.5.2 on Windows Server 2012 R2
Microsoft .NET Framework 4.5.2 on Windows RT 8.1
Microsoft .NET Framework 4.5.2 on Windows Server 2012 R2 (Server Core installation)
Microsoft .NET Framework 4.5.2 on Windows Server 2008 for 32-bit Systems Service Pack 2
Microsoft .NET Framework 4.5.2 on Windows Server 2008 for x64-based Systems Service Pack 2
Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 for x64-based Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1511 for x64-based Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1511 for 32-bit Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for 32-bit Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for x64-based Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1703 for 32-bit Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1703 for x64-based Systems
Microsoft .NET Framework 4.6 on Windows 10 for 32-bit Systems
Microsoft .NET Framework 4.6 on Windows 10 for x64-based Systems
Microsoft .NET Framework 4.6 on Windows Server 2008 for 32-bit Systems Service Pack 2
Microsoft .NET Framework 4.6 on Windows Server 2008 for x64-based Systems Service Pack 2
Windows 10 for 32-bit Systems
Microsoft Office 2016 for Mac
Windows 10 for x64-based Systems
Microsoft Word 2016 (32-bit edition)
Microsoft Word 2016 (64-bit edition)
Microsoft Office Online Server 2016
Microsoft Office 2016 (32-bit edition)
Microsoft Office 2016 (64-bit edition)
Skype for Business 2016 (32-bit)
Skype for Business 2016 (64-bit)
Windows 10 Version 1511 for x64-based Systems
Windows 10 Version 1511 for 32-bit Systems
Microsoft Exchange Server 2016
Microsoft .NET Framework 4.6/4.6.1 on Windows 7 for 32-bit Systems Service Pack 1
Microsoft .NET Framework 4.6/4.6.1 on Windows 7 for x64-based Systems Service Pack 1
Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2012
Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2012 (Server Core installation)
Microsoft .NET Framework 4.6/4.6.1 on Windows 8.1 for 32-bit systems
Microsoft .NET Framework 4.6/4.6.1 on Windows 8.1 for x64-based systems
Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2012 R2
Microsoft .NET Framework 4.6/4.6.1 on Windows RT 8.1
Microsoft .NET Framework 4.6/4.6.1 on Windows Server 2012 R2 (Server Core installation)
Microsoft .NET Framework 4.6.1 on Windows 10 Version 1511 for x64-based Systems
Microsoft .NET Framework 4.6.1 on Windows 10 Version 1511 for 32-bit Systems
Windows Server 2016
Windows 10 Version 1607 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows Server 2016 (Server Core installation)
Microsoft .NET Framework 4.6.2 on Windows 7 for 32-bit Systems Service Pack 1
Microsoft .NET Framework 4.6.2 on Windows 7 for x64-based Systems Service Pack 1
Microsoft .NET Framework 4.6.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Microsoft .NET Framework 4.6.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
Microsoft .NET Framework 4.6.2 on Windows Server 2012
Microsoft .NET Framework 4.6.2 on Windows Server 2012 (Server Core installation)
Microsoft .NET Framework 4.6.2 on Windows 8.1 for 32-bit systems
Microsoft .NET Framework 4.6.2 on Windows 8.1 for x64-based systems
Microsoft .NET Framework 4.6.2 on Windows Server 2012 R2
Microsoft .NET Framework 4.6.2 on Windows RT 8.1
Microsoft .NET Framework 4.6.2 on Windows Server 2012 R2 (Server Core installation)
Microsoft .NET Framework 4.6.2 on Windows Server 2016
Microsoft .NET Framework 4.6.2 on Windows 10 Version 1607 for 32-bit Systems
Microsoft .NET Framework 4.6.2 on Windows 10 Version 1607 for x64-based Systems
Microsoft .NET Framework 4.6.2 on Windows Server 2016 (Server Core installation)
Windows 10 Version 1703 for 32-bit Systems
Windows 10 Version 1703 for x64-based Systems
Microsoft .NET Framework 4.7 on Windows 10 Version 1703 for 32-bit Systems
Microsoft .NET Framework 4.7 on Windows 10 Version 1703 for x64-based Systems
Microsoft SharePoint Enterprise Server 2013 Service Pack 1
Microsoft Endpoint Protection
Microsoft Forefront Endpoint Protection 2010
Microsoft System Center Endpoint Protection
Microsoft Office Word Viewer
azl3 fltk 1.3.8-1 on Azure Linux 3.0
azl3 fltk 1.3.8-1 on Azure Linux 3.0
cm1 kernel 5.10.57.1-1 on CBL Mariner 1.0
cbl2 avahi 0.8-1 on CBL Mariner 2.0
cbl2 php 7.4.14-3 on CBL Mariner 2.0
azl3 rubygem-mini_portile2 2.8.4-1 on Azure Linux 3.0
cbl2 shim-unsigned-aarch64 15-5 on CBL Mariner 2.0
cbl2 boost 1.76.0-4 on CBL Mariner 2.0
cbl2 shim-unsigned-x64 15.8-1 on CBL Mariner 2.0
azl3 shim-unsigned-aarch64 16.1-1 on Azure Linux 3.0
azl3 shim-unsigned-x64 16.1-1 on Azure Linux 3.0
azl3 shim-unsigned-aarch64 16.1-2 on Azure Linux 3.0
azl3 shim-unsigned-x64 16.1-2 on Azure Linux 3.0
Microsoft .NET Framework 3.5 on Windows Server 2012
Microsoft .NET Framework 3.5 on Windows Server 2012 (Server Core installation)
Microsoft .NET Framework 3.5 on Windows 8.1 for 32-bit systems
Microsoft .NET Framework 3.5 on Windows 8.1 for x64-based systems
Microsoft .NET Framework 3.5 on Windows Server 2012 R2
Microsoft .NET Framework 3.5 on Windows Server 2012 R2 (Server Core installation)
Microsoft .NET Framework 3.5 on Windows 10 for 32-bit Systems
Microsoft .NET Framework 3.5 on Windows 10 for x64-based Systems
Microsoft .NET Framework 3.5 on Windows 10 Version 1511 for x64-based Systems
Microsoft .NET Framework 3.5 on Windows 10 Version 1511 for 32-bit Systems
Microsoft .NET Framework 3.5 on Windows Server 2016
Microsoft .NET Framework 3.5 on Windows 10 Version 1607 for 32-bit Systems
Microsoft .NET Framework 3.5 on Windows 10 Version 1607 for x64-based Systems
Microsoft .NET Framework 3.5 on Windows Server 2016 (Server Core installation)
Microsoft .NET Framework 3.5 on Windows 10 Version 1703 for 32-bit Systems
Microsoft .NET Framework 3.5 on Windows 10 Version 1703 for x64-based Systems
Windows Defender on Windows 7 for 32-bit Systems Service Pack 1
Windows Defender on Windows 7 for x64-based Systems Service Pack 1
Windows Defender on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Defender on Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Windows Defender on Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Defender on Windows 8.1 for 32-bit systems
Windows Defender on Windows 8.1 for x64-based systems
Windows Defender on Windows RT 8.1
Windows Defender on Windows 10 for 32-bit Systems
Windows Defender on Windows 10 for x64-based Systems
Windows Defender on Windows 10 Version 1511 for x64-based Systems
Windows Defender on Windows 10 Version 1511 for 32-bit Systems
Windows Defender on Windows Server 2016
Windows Defender on Windows 10 Version 1607 for 32-bit Systems
Windows Defender on Windows 10 Version 1607 for x64-based Systems
Windows Defender on Windows Server 2016 (Server Core installation)
Windows Defender on Windows 10 Version 1703 for 32-bit Systems
Windows Defender on Windows 10 Version 1703 for x64-based Systems
Microsoft Office Compatibility Pack Service Pack 3
Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2
Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2
Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-Based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Word Automation Services on Microsoft SharePoint Server 2010 Service Pack 2
Word Automation Services on Microsoft SharePoint Server 2013 Service Pack 1
Microsoft .NET Framework 3.5.1 on Windows 7 for 32-bit Systems Service Pack 1
Microsoft .NET Framework 3.5.1 on Windows 7 for x64-based Systems Service Pack 1
Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1
Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1
Microsoft SharePoint Enterprise Server 2016
avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link which allows remote attackers to cause a denial of service (traffic amplification) and may cause information leakage by obtaining potentially sensitive information from the responding device via port-5353 UDP packets. NOTE: this may overlap CVE-2015-2809.
<p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p>
<p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p>
Mariner
mitre
Yes
CVE-2017-6519
Origin Validation Error
16915-16823
16915-16823
Critical
16915-16823
9.1
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
16915-16823
CBL-Mariner Releases
16915-16823
No
Security Update
0.8-1
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
16915-16823
CBL-Mariner Releases
1.0
2021-12-16T00:00:00
<p>Information published.</p>
In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel prtd is assigned substream->runtime->private_data. Later prtd is freed. However prtd is not sanitized and set to NULL resulting in a dangling pointer. There are other functions that access the same memory (substream->runtime->private_data) with a NULL check such as msm_pcm_volume_ctl_put() which means this freed memory could be used.
<p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p>
<p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p>
Mariner
qualcomm
Yes
CVE-2017-8246
Use After Free
16840-16820
16840-16820
Important
16840-16820
7.8
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
16840-16820
CBL-Mariner Releases
16840-16820
No
Security Update
-
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
16840-16820
CBL-Mariner Releases
1.0
2020-09-25T00:00:00
<p>Information published.</p>
The regulator_ena_gpio_free function in drivers/regulator/core.c in the Linux kernel before 3.19 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application.
<p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p>
<p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p>
Mariner
google_android
Yes
CVE-2014-9940
Use After Free
1.0
2023-10-11T00:00:00
<p>Information published.</p>
The inflateMark function in inflate.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact
<p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p>
<p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p>
Mariner
microfocus
Yes
CVE-2016-9842
16826-17084
19746-17084
16826-16817
16826-17084
19746-17084
16826-16817
Important
16826-17084
Important
19746-17084
Important
16826-16817
8.8
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
16826-17084
8.8
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
19746-17084
8.8
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
16826-16817
CBL-Mariner Releases
16826-17084
16826-16817
No
Security Update
1.3.8-1
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
16826-17084
16826-16817
CBL-Mariner Releases
1.0
2025-03-14T00:00:00
<p>Information published.</p>
1.1
2026-02-18T14:10:49
<p>Information published.</p>
The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation.
<p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p>
<p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p>
Mariner
microfocus
Yes
CVE-2016-9843
16826-17084
16826-16817
19746-17084
16826-17084
16826-16817
19746-17084
Critical
16826-17084
Critical
16826-16817
Critical
19746-17084
9.8
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
16826-17084
9.8
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
16826-16817
9.8
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
19746-17084
CBL-Mariner Releases
16826-17084
16826-16817
No
Security Update
1.3.8-1
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
16826-17084
16826-16817
CBL-Mariner Releases
1.0
2025-03-14T00:00:00
<p>Information published.</p>
1.1
2026-02-18T14:38:43
<p>Information published.</p>
The zend_string_extend function in Zend/zend_string.h in PHP through 7.1.5 does not prevent changes to string objects that result in a negative length, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact by leveraging a script's use of .= with a long string.
<p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p>
<p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p>
Mariner
mitre
Yes
CVE-2017-8923
Out-of-bounds Write
16917-16823
16917-16823
Critical
16917-16823
9.8
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
16917-16823
CBL-Mariner Releases
16917-16823
No
Security Update
7.4.14-3
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
16917-16823
CBL-Mariner Releases
1.0
2025-10-01T23:11:00
<p>Information published.</p>
Truncated packet could crash via OOB read
Mariner
openssl
Yes
CVE-2017-3731
19800-17086
21242-17084
21243-17084
21275-17084
19816-17086
21277-17084
19800-17086
21242-17084
21243-17084
21275-17084
19816-17086
21277-17084
Important
19800-17086
Important
21242-17084
Important
21243-17084
Important
21275-17084
Important
19816-17086
Important
21277-17084
7.5
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
19800-17086
7.5
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
21242-17084
7.5
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
21243-17084
7.5
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
21275-17084
7.5
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
19816-17086
7.5
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
21277-17084
2.0
2026-04-27T14:45:39
<p>Information published.</p>
3.0
2026-04-29T14:51:08
<p>Information published.</p>
1.0
2026-04-26T01:07:54
<p>Information published.</p>
4.0
2026-04-30T01:51:04
<p>Information published.</p>
In core_info_read and inst_info_read in all Android releases from CAF using the Linux kernel variable "dbg_buf" "dbg_buf->curr" and "dbg_buf->filled_size" could be modified by different threads at the same time but they are not protected with mutex or locks. Buffer overflow is possible on race conditions. "buffer->curr" itself could also be overwritten which means that it may point to anywhere of kernel memory (for write).
<p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p>
<p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p>
Mariner
qualcomm
Yes
CVE-2017-8244
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
16840-16820
16840-16820
Important
16840-16820
7.0
7.0
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
16840-16820
CBL-Mariner Releases
16840-16820
No
Security Update
-
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
16840-16820
CBL-Mariner Releases
1.0
2020-09-25T00:00:00
<p>Information published.</p>
In all Android releases from CAF using the Linux kernel while processing a voice SVC request which is nonstandard by specifying a payload size that will overflow its own declared size an out of bounds memory copy occurs.
<p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p>
<p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p>
Mariner
qualcomm
Yes
CVE-2017-8245
Improper Restriction of Operations within the Bounds of a Memory Buffer
16840-16820
16840-16820
Important
16840-16820
7.8
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
16840-16820
CBL-Mariner Releases
16840-16820
No
Security Update
-
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
16840-16820
CBL-Mariner Releases
1.0
2020-09-25T00:00:00
<p>Information published.</p>
inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic
<p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p>
<p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p>
Mariner
microfocus
Yes
CVE-2016-9840
16826-17084
19802-17086
16826-16817
19746-17084
16826-17084
19802-17086
16826-16817
19746-17084
Important
16826-17084
Important
19802-17086
Important
16826-16817
Important
19746-17084
8.8
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
16826-17084
8.8
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
19802-17086
8.8
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
16826-16817
8.8
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
19746-17084
CBL-Mariner Releases
16826-17084
16826-16817
No
Security Update
1.3.8-1
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
16826-17084
16826-16817
CBL-Mariner Releases
CBL-Mariner Releases
19802-17086
No
Security Update
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
19802-17086
CBL-Mariner Releases
1.0
2025-03-14T00:00:00
<p>Information published.</p>
1.1
2026-02-18T01:09:12
<p>Information published.</p>
inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic
<p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p>
<p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p>
Mariner
microfocus
Yes
CVE-2016-9841
16826-17084
16826-16817
19746-17084
16826-17084
16826-16817
19746-17084
Critical
16826-17084
Critical
16826-16817
Critical
19746-17084
9.8
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
16826-17084
9.8
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
16826-16817
9.8
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
19746-17084
CBL-Mariner Releases
16826-17084
16826-16817
No
Security Update
1.3.8-1
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
16826-17084
16826-16817
CBL-Mariner Releases
1.0
2025-03-14T00:00:00
<p>Information published.</p>
1.1
2026-02-18T01:12:06
<p>Information published.</p>
Windows GDI Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system. By itself, the information disclosure does not allow arbitrary code execution; however, it could allow arbitrary code to be run if the attacker uses it in combination with another vulnerability.</p>
<p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.</p>
<p>The security update addresses the vulnerability by correcting how GDI handles memory addresses.</p>
Microsoft Graphics Component
CVE-2017-0190
10729
10735
10789
10788
10852
10853
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
Information Disclosure
10729
Information Disclosure
10735
Information Disclosure
10789
Information Disclosure
10788
Information Disclosure
10852
Information Disclosure
10853
Information Disclosure
10047
Information Disclosure
10048
Information Disclosure
10481
Information Disclosure
10482
Information Disclosure
10484
Information Disclosure
9312
Information Disclosure
10287
Information Disclosure
9311
Information Disclosure
9318
Information Disclosure
9344
Information Disclosure
10050
Information Disclosure
10051
Information Disclosure
10049
Information Disclosure
10378
Information Disclosure
10379
Information Disclosure
10483
Information Disclosure
10543
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation Unlikely;DOS:Temporary
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10729
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10735
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10789
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10788
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10852
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10853
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10047
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10048
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10481
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10482
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10484
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
9312
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10287
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
9311
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
9318
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
9344
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10050
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10051
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10049
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10378
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10379
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10483
4.2
3.8
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10543
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4019206
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019206
3204724
9312
Yes
Security Update
4019206
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019206
3204724
10287
Yes
Security Update
4019206
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019206
3204724
9311
Yes
Security Update
4019206
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019206
3204724
9318
Yes
Security Update
4019206
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019206
3204724
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
Symeon Paraschoudis of <a href="http://wwww.sensepost.com">SensePost</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Scripting Engine Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.</p>
<p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the related rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p>
<p>An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines handle objects in memory.</p>
Microsoft Scripting Engine
CVE-2017-0223
10724-10951
10724-10952
Remote Code Execution
10724-10951
Remote Code Execution
10724-10952
Critical
10724-10951
Critical
10724-10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10951
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10952
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10952
Yes
Security Update
Christian Holler (decoder, <a href="https://www.twitter.com/mozdeco">@mozdeco</a>) - <a href="http://own-hero.net/">own-hero Team</a>
Microsoft ChakraCore Team
1.0
2017-05-19T07:00:00Z
<p>Information published. This CVE was addressed by KB4016871, but was inadvertently omitted from the May 2017 Security Updates. This is an informational change only.</p>
Scripting Engine Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.</p>
<p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the related rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p>
<p>An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines handle objects in memory.</p>
Microsoft Edge
CVE-2017-0224
10724-10951
10724-10952
Remote Code Execution
10724-10951
Remote Code Execution
10724-10952
Critical
10724-10951
Critical
10724-10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10951
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10952
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10952
Yes
Security Update
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Dxgkrnl.sys Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists when the Windows improperly handles objects in memory. In a local attack scenario, an attacker could exploit this vulnerability by running a specially crafted application to take control over the affected system. An attacker who successfully exploited this vulnerability could run processes in an elevated context. On systems with Windows 8.1 or later installed, this vulnerability can lead to denial of service.</p>
<p>The update addresses the vulnerability by correcting the way in which the Microsoft DirectX graphics kernel subsystem (dxgkrnl.sys) handles certain calls and escapes to preclude improper memory mapping and prevent unintended elevation from user-mode.</p>
Microsoft Graphics Component
CVE-2017-0077
10951
10952
10816
10729
10735
10789
10788
10852
10853
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10855
Denial of Service
10951
Denial of Service
10952
Denial of Service
10816
Denial of Service
10729
Denial of Service
10735
Denial of Service
10789
Denial of Service
10788
Denial of Service
10852
Denial of Service
10853
Elevation of Privilege
10047
Elevation of Privilege
10048
Denial of Service
10481
Denial of Service
10482
Denial of Service
10484
Elevation of Privilege
9312
Elevation of Privilege
10287
Elevation of Privilege
9311
Elevation of Privilege
9318
Elevation of Privilege
9344
Elevation of Privilege
10050
Denial of Service
10051
Elevation of Privilege
10049
Denial of Service
10378
Denial of Service
10379
Denial of Service
10483
Denial of Service
10543
Denial of Service
10855
Important
10951
Important
10952
Important
10816
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10855
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely;DOS:Permanent
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10951
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10952
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10816
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10729
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10735
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10789
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10788
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10852
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10853
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10047
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10048
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10481
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10482
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10484
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9312
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10287
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9311
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
9318
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
9344
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10050
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10051
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10049
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10378
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10379
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10483
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10543
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4019149
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019149
3156017
9312
Yes
Security Update
4019149
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019149
3156017
10287
Yes
Security Update
4019149
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019149
3156017
9311
Yes
Security Update
4019149
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019149
3156017
9318
Yes
Security Update
4019149
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019149
3156017
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
<a href="http://weibo.com/pgboy1988">pgboy</a> and <a href="http://weibo.com/2641521260">zhong_sf</a> of <a href="http://www.360.cn/">Qihoo 360 Vulcan Team</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Microsoft ActiveX Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists in the way some ActiveX objects are instantiated. An attacker who successfully exploited this vulnerability could gain access to protected memory contents.</p>
<p>To exploit this vulnerability, an attacker would need to convince a user to open a malicious document that could then instantiate the vulnerable object. This security update addresses the vulnerability by correcting how these objects are instantiated.</p>
Microsoft ActiveX
CVE-2017-0242
10047
10048
9312
10287
9311
9318
9344
10050
10051
10049
Information Disclosure
10047
Information Disclosure
10048
Information Disclosure
9312
Information Disclosure
10287
Information Disclosure
9311
Information Disclosure
9318
Information Disclosure
9344
Information Disclosure
10050
Information Disclosure
10051
Information Disclosure
10049
Important
10047
Important
10048
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
4.2
3.8
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
10047
4.2
3.8
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
10048
4.2
3.8
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
9312
4.2
3.8
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
10287
4.2
3.8
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
9311
4.2
3.8
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
9318
4.2
3.8
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
9344
4.2
3.8
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
10050
4.2
3.8
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
10051
4.2
3.8
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
10049
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4018927
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018927
9312
Maybe
Security Update
4018927
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018927
10287
Maybe
Security Update
4018927
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018927
9311
Maybe
Security Update
4018927
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018927
9318
Maybe
Security Update
4018927
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018927
9344
Maybe
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
<a href="http://dsec.ru">Digital Security</a>
Richard Warren of <a href=" https://www.nccgroup.trust/us/"> NCC Group </a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows Kernel Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the
vulnerability could execute code with elevated permissions. On systems with Windows 7 for x64-based Systems or later installed, this vulnerability can lead to denial of service.</p>
<p>To exploit the vulnerability, an attacker would have to either log on locally to an affected system, or convince a locally authenticated user to execute a specially crafted application.</p>
<p>The security update addresses the vulnerability by ensuring the Windows Kernel properly handles objects in memory.</p>
Microsoft Graphics Component
CVE-2017-0244
10047
10048
9312
10287
9311
9318
9344
10050
10051
10049
Elevation of Privilege
10047
Denial of Service
10048
Elevation of Privilege
9312
Elevation of Privilege
10287
Elevation of Privilege
9311
Denial of Service
9318
Denial of Service
9344
Elevation of Privilege
10050
Denial of Service
10051
Denial of Service
10049
Important
10047
Important
10048
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A;Older Software Release:Exploitation More Likely;DOS:Permanent
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
10047
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
10048
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
9312
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
10287
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
9311
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
9318
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
9344
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
10050
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
10051
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
10049
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9312
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
10287
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9311
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9318
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
Stéfan Le Berre <a href="http://esec-lab.sogeti.com/">Sogeti ESEC R&D</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Win32k Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p>
<p>To exploit the vulnerability, an attacker would have to either log on locally to an affected system, or convince a locally authenticated user to execute a specially crafted application.</p>
<p>The security update addresses the vulnerability by correcting how win32k handles objects in memory.</p>
Microsoft Graphics Component
CVE-2017-0245
10047
10048
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
Information Disclosure
10047
Information Disclosure
10048
Information Disclosure
9312
Information Disclosure
10287
Information Disclosure
9311
Information Disclosure
9318
Information Disclosure
9344
Information Disclosure
10050
Information Disclosure
10051
Information Disclosure
10049
Information Disclosure
10378
Information Disclosure
10379
Important
10047
Important
10048
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A;Older Software Release:Exploitation Less Likely
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10047
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10048
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
9312
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10287
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
9311
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
9318
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
9344
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10050
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10051
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10049
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10378
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10379
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
9312
Yes
Security Update
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
10287
Yes
Security Update
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
9311
Yes
Security Update
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
9318
Yes
Security Update
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
Mateusz Jurczyk of <a href="http://www.google.com">Google Project Zero</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Win32k Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.</p>
<p>The update addresses this vulnerability by correcting how the Windows kernel-mode driver handles objects in memory.</p>
Microsoft Graphics Component
CVE-2017-0246
10735
10789
10788
10852
10853
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10729
10951
10952
10816
10855
Denial of Service
10735
Denial of Service
10789
Denial of Service
10788
Denial of Service
10852
Denial of Service
10853
Elevation of Privilege
10047
Denial of Service
10048
Denial of Service
10481
Denial of Service
10482
Elevation of Privilege
10484
Elevation of Privilege
9312
Elevation of Privilege
10287
Elevation of Privilege
9311
Denial of Service
9318
Denial of Service
9344
Elevation of Privilege
10050
Denial of Service
10051
Denial of Service
10049
Denial of Service
10378
Denial of Service
10379
Denial of Service
10483
Denial of Service
10543
Denial of Service
10729
Denial of Service
10951
Denial of Service
10952
Denial of Service
10816
Denial of Service
10855
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10729
Important
10951
Important
10952
Important
10816
Important
10855
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation More Likely;DOS:Permanent
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10735
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10789
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10788
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10852
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10853
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
10047
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10048
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10481
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10482
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
10484
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
9312
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
10287
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
9311
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
9318
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
9344
7.0
7.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
10050
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10051
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10049
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10378
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10379
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10483
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10543
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10729
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10951
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10952
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10816
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
10855
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
9312
Yes
Security Update
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
10287
Yes
Security Update
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
9311
Yes
Security Update
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
9318
Yes
Security Update
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
Rancho Ice, Huang Jialong <a href="http://www.qq.com/"> Tencent Security ZhanluLab </a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
.NET Security Feature Bypass Vulnerability
<p>A security feature bypass vulnerability exists when Microsoft .NET Framework (and .NET Core) components do not completely validate certificates.</p>
<p>An attacker could present a certificate that is marked invalid for a specific use, but the component uses it for that purpose. This action disregards the Enhanced Key Usage taggings.</p>
<p>The security update addresses the vulnerability by helping to ensure that .NET Framework (and .NET Core) components completely validate certificates.</p>
<p><strong>How do I determine which version of Microsoft .NET Framework is installed on my system?</strong>
You can install and run multiple versions of .NET Framework on a system, and you can install the versions in any order. For more information, see <a href="https://support.microsoft.com/kb/318785">Microsoft Knowledge Base Article 318785</a>.</p>
<p><strong>How do I locate the updates for the versions of .NET Framework installed on my system?</strong>
The download links in the Affected Products table are to the Parent KB number in the Microsoft Update Catalog. To locate the packages you need to download, in the Microsoft Update Catalog, click <strong>Download</strong> for the platform you have installed on your system. In the <strong>Download</strong> window, click to download each update that is applicable to your system.</p>
<p>Customers who have updates automatically installed will be offered the Parent KB; however, the package KB numbers listed for each platform will be displayed in Add Remove Programs.</p>
<p>The following table lists the Parent KB numbers for the Monthly Rollup Releases and the Security Only Releases, and the package KB numbers they contain. For more information about Microsoft's update servicing model for Microsoft .NET Framework, see this <a href="https://go.microsoft.com/fwlink/?linkid=829975">Microsoft .NET Blog Post</a>.</p>
<table>
<thead>
<tr>
<th>Monthly Rollup Release</th>
<th></th>
<th>Security Only Release</th>
<th></th>
<th></th>
</tr>
</thead>
<tbody>
<tr>
<td>Platform</td>
<td>Parent KB</td>
<td>Child KBs</td>
<td>Parent KB</td>
<td>Child KBs</td>
</tr>
<tr>
<td>Windows Server 2008</td>
<td>4019115</td>
<td>4014502 - .NET Framework 2.0</td>
<td>4019109</td>
<td>4014575 - .NET Framework 2.0</td>
</tr>
<tr>
<td></td>
<td></td>
<td>4014514 - .NET Framework 4.5.2</td>
<td></td>
<td>4014599 - .NET Framework 4.5.2</td>
</tr>
<tr>
<td></td>
<td></td>
<td>4014511 - .NET Framework 4.6</td>
<td></td>
<td>4014591- .NET Framework 4.6</td>
</tr>
<tr>
<td>Windows 7</td>
<td>4019112</td>
<td>4014504 - .NET Framework 3.5.1</td>
<td>4019108</td>
<td>4014579 - .NET Framework 3.5.1</td>
</tr>
<tr>
<td>Windows Server 2008 R2</td>
<td></td>
<td>4014514 - .NET Framework 4.5.2</td>
<td></td>
<td>4014599 - .NET Framework 4.5.2</td>
</tr>
<tr>
<td></td>
<td></td>
<td>4014511 - .NET Framework 4.6/4.6.1</td>
<td></td>
<td>4014591 - .NET Framework 4.6/4.6.1</td>
</tr>
<tr>
<td></td>
<td></td>
<td>4014508 - .NET Framework 4.6.2</td>
<td></td>
<td>4014588 - .NET Framework 4.6.2</td>
</tr>
<tr>
<td>Windows Server 2012</td>
<td>4019113</td>
<td>4014503 - .NET Framework 3.5</td>
<td>4019110</td>
<td>4014577 - .NET Framework 3.5</td>
</tr>
<tr>
<td></td>
<td></td>
<td>4014513 - .NET Framework 4.5.2</td>
<td></td>
<td>4014597 - .NET Framework 4.5.2</td>
</tr>
<tr>
<td></td>
<td></td>
<td>4014509 - .NET Framework 4.6/4.6.1</td>
<td></td>
<td>4014589 - .NET Framework 4.6/4.6.1</td>
</tr>
<tr>
<td></td>
<td></td>
<td>4014506 - .NET Framework 4.6.2</td>
<td></td>
<td>4014586 - .NET Framework 4.6.2</td>
</tr>
<tr>
<td>Windows 8.1</td>
<td>4019114</td>
<td>4014505 - .NET Framework 3.5</td>
<td>4019111</td>
<td>4014581 - .NET Framework 3.5</td>
</tr>
<tr>
<td>Windows Server 2012 R2</td>
<td></td>
<td>4014512 - .NET Framework 4.5.2</td>
<td></td>
<td>4014595 - .NET Framework 4.5.2</td>
</tr>
<tr>
<td></td>
<td></td>
<td>4014510 - .NET Framework 4.6/4.6.1</td>
<td></td>
<td>4014590 - .NET Framework 4.6/4.6.1</td>
</tr>
<tr>
<td></td>
<td></td>
<td>4014507 - .NET Framework 4.6.2</td>
<td></td>
<td>4014587 - .NET Framework 4.6.2</td>
</tr>
<tr>
<td>Windows 10 Platforms</td>
<td>Parent KB</td>
<td>.NET Framework Product</td>
<td></td>
<td></td>
</tr>
<tr>
<td>Windows 10</td>
<td>4019474</td>
<td>.NET Framework 3.5</td>
<td></td>
<td>None</td>
</tr>
<tr>
<td></td>
<td></td>
<td>.NET Framework 4.6</td>
<td></td>
<td></td>
</tr>
<tr>
<td>Windows 10 Version 1511</td>
<td>4019473</td>
<td>.NET Framework 3.5</td>
<td></td>
<td>None</td>
</tr>
<tr>
<td></td>
<td></td>
<td>.NET Framework 4.6.1</td>
<td></td>
<td></td>
</tr>
<tr>
<td>Windows 10 Version 1607</td>
<td>4019472</td>
<td>.NET Framework 3.5</td>
<td></td>
<td>None</td>
</tr>
<tr>
<td></td>
<td></td>
<td>.NET Framework 4.6.2</td>
<td></td>
<td></td>
</tr>
<tr>
<td>Windows Server 2016</td>
<td>4019472</td>
<td>.NET Framework 3.5</td>
<td></td>
<td>None</td>
</tr>
<tr>
<td></td>
<td></td>
<td>.NET Framework 4.6.2</td>
<td></td>
<td></td>
</tr>
<tr>
<td>Windows 10 Version 1703</td>
<td>4019471</td>
<td>.NET Framework 4.7</td>
<td></td>
<td>None</td>
</tr>
</tbody>
</table>
.NET Framework
CVE-2017-0248
9292-9311
9292-9312
9292-9318
2472-10379
2472-10378
9495-10047
9495-10051
9495-10050
9495-10049
9495-10048
10900-10483
10900-10543
10900-10378
10900-10379
10900-10482
10900-10047
10900-10051
10900-10049
10900-10048
10900-10481
10900-10852
10900-10853
10900-10816
10900-10855
2472-10481
2472-10482
2472-10483
2472-10543
2472-10729
2472-10735
2472-10789
2472-10788
2472-10852
2472-10853
2472-10951
2472-10952
2472-10816
2472-10855
10636-9312
10636-9318
10636-10047
10636-10048
10636-10051
10636-10378
10636-10379
10636-10481
10636-10482
10636-10484
10636-10483
10636-10543
10728-9312
10728-9318
10728-10729
10728-10735
10808-10789
10808-10788
10900-10484
10807-10047
10807-10048
10807-10051
10807-10049
10807-10378
10807-10379
10807-10483
10807-10543
10807-10481
10807-10482
10807-10484
10957-10951
10957-10952
Security Feature Bypass
9292-9311
Security Feature Bypass
9292-9312
Security Feature Bypass
9292-9318
Security Feature Bypass
2472-10379
Security Feature Bypass
2472-10378
Security Feature Bypass
9495-10047
Security Feature Bypass
9495-10051
Security Feature Bypass
9495-10050
Security Feature Bypass
9495-10049
Security Feature Bypass
9495-10048
Security Feature Bypass
10900-10483
Security Feature Bypass
10900-10543
Security Feature Bypass
10900-10378
Security Feature Bypass
10900-10379
Security Feature Bypass
10900-10482
Security Feature Bypass
10900-10047
Security Feature Bypass
10900-10051
Security Feature Bypass
10900-10049
Security Feature Bypass
10900-10048
Security Feature Bypass
10900-10481
Security Feature Bypass
10900-10852
Security Feature Bypass
10900-10853
Security Feature Bypass
10900-10816
Security Feature Bypass
10900-10855
Security Feature Bypass
2472-10481
Security Feature Bypass
2472-10482
Security Feature Bypass
2472-10483
Security Feature Bypass
2472-10543
Security Feature Bypass
2472-10729
Security Feature Bypass
2472-10735
Security Feature Bypass
2472-10789
Security Feature Bypass
2472-10788
Security Feature Bypass
2472-10852
Security Feature Bypass
2472-10853
Security Feature Bypass
2472-10951
Security Feature Bypass
2472-10952
Security Feature Bypass
2472-10816
Security Feature Bypass
2472-10855
Security Feature Bypass
10636-9312
Security Feature Bypass
10636-9318
Security Feature Bypass
10636-10047
Security Feature Bypass
10636-10048
Security Feature Bypass
10636-10051
Security Feature Bypass
10636-10378
Security Feature Bypass
10636-10379
Security Feature Bypass
10636-10481
Security Feature Bypass
10636-10482
Security Feature Bypass
10636-10484
Security Feature Bypass
10636-10483
Security Feature Bypass
10636-10543
Security Feature Bypass
10728-9312
Security Feature Bypass
10728-9318
Security Feature Bypass
10728-10729
Security Feature Bypass
10728-10735
Security Feature Bypass
10808-10789
Security Feature Bypass
10808-10788
Security Feature Bypass
10900-10484
Security Feature Bypass
10807-10047
Security Feature Bypass
10807-10048
Security Feature Bypass
10807-10051
Security Feature Bypass
10807-10049
Security Feature Bypass
10807-10378
Security Feature Bypass
10807-10379
Security Feature Bypass
10807-10483
Security Feature Bypass
10807-10543
Security Feature Bypass
10807-10481
Security Feature Bypass
10807-10482
Security Feature Bypass
10807-10484
Security Feature Bypass
10957-10951
Security Feature Bypass
10957-10952
Important
9292-9311
Important
9292-9312
Important
9292-9318
Important
2472-10379
Important
2472-10378
Important
9495-10047
Important
9495-10051
Important
9495-10050
Important
9495-10049
Important
9495-10048
Important
10900-10483
Important
10900-10543
Important
10900-10378
Important
10900-10379
Important
10900-10482
Important
10900-10047
Important
10900-10051
Important
10900-10049
Important
10900-10048
Important
10900-10481
Important
10900-10852
Important
10900-10853
Important
10900-10816
Important
10900-10855
Important
2472-10481
Important
2472-10482
Important
2472-10483
Important
2472-10543
Important
2472-10729
Important
2472-10735
Important
2472-10789
Important
2472-10788
Important
2472-10852
Important
2472-10853
Important
2472-10951
Important
2472-10952
Important
2472-10816
Important
2472-10855
Important
10636-9312
Important
10636-9318
Important
10636-10047
Important
10636-10048
Important
10636-10051
Important
10636-10378
Important
10636-10379
Important
10636-10481
Important
10636-10482
Important
10636-10484
Important
10636-10483
Important
10636-10543
Important
10728-9312
Important
10728-9318
Important
10728-10729
Important
10728-10735
Important
10808-10789
Important
10808-10788
Important
10900-10484
Important
10807-10047
Important
10807-10048
Important
10807-10051
Important
10807-10049
Important
10807-10378
Important
10807-10379
Important
10807-10483
Important
10807-10543
Important
10807-10481
Important
10807-10482
Important
10807-10484
Important
10957-10951
Important
10957-10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation Unlikely;DOS:N/A
4019115
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019115
4014984, 3216520, 3142023
9292-9311
Maybe
Monthly Rollup
4019109
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019109
9292-9311
Maybe
Security Only
4019115
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019115
4014984, 3216520, 3142023
9292-9312
Maybe
Monthly Rollup
4019109
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019109
3142037
9292-9312
Maybe
Security Only
4019115
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019115
4014984, 3216520, 3142023
9292-9318
Maybe
Monthly Rollup
4019109
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019109
3142037
9292-9318
Maybe
Security Only
4019113
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019113
4014982, 3216522, 3135984, 3142025, 2729462
2472-10379
Maybe
Monthly Rollup
4019110
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019110
2472-10379
Maybe
Security Only
4019113
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019113
4014982, 3216522, 3135984, 3142025, 2729462
2472-10378
Maybe
Monthly Rollup
4019110
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019110
2472-10378
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981, 3216523, 3135983, 3142024
9495-10047
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
3142037
9495-10047
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981, 3216523, 3135983, 3142024
9495-10051
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
3142037
9495-10051
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981, 3216523, 3135983, 3142024
9495-10050
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
9495-10050
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981, 3216523, 3135983, 3142024
9495-10049
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
3142037
9495-10049
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981, 3216523, 3135983, 3142024
9495-10048
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
3142037
9495-10048
Maybe
Security Only
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983
10900-10483
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
10900-10483
Maybe
Security Only
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983
10900-10543
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
10900-10543
Maybe
Security Only
4019113
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019113
4014982
10900-10378
Maybe
Monthly Rollup
4019110
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019110
10900-10378
Maybe
Security Only
4019113
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019113
4014982
10900-10379
Maybe
Monthly Rollup
4019110
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019110
10900-10379
Maybe
Security Only
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983
10900-10482
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
10900-10482
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981
10900-10047
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
3142037
10900-10047
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981
10900-10051
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
3142037
10900-10051
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981
10900-10049
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
3142037
10900-10049
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981
10900-10048
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
3142037
10900-10048
Maybe
Security Only
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983
10900-10481
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
10900-10481
Maybe
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10900-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10900-10853
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10900-10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10900-10855
Yes
Security Update
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983, 3216521, 3135985, 3142026
2472-10481
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
2472-10481
Maybe
Security Only
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983, 3216521, 3135985, 3142026
2472-10482
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
2472-10482
Maybe
Security Only
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983, 3216521, 3135985, 3142026
2472-10483
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
2472-10483
Maybe
Security Only
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983, 3216521, 3135985, 3142026
2472-10543
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
2472-10543
Maybe
Security Only
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
2472-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
2472-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
2472-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
2472-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
2472-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
2472-10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
2472-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
2472-10952
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
2472-10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
2472-10855
Yes
Security Update
4019115
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019115
4014984, 3216520
10636-9312
Maybe
Monthly Rollup
4019109
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019109
3142037
10636-9312
Maybe
Security Only
4019115
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019115
4014984, 3216520
10636-9318
Maybe
Monthly Rollup
4019109
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019109
3142037
10636-9318
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981, 3216523
10636-10047
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
3142037
10636-10047
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981, 3216523
10636-10048
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
10636-10048
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981, 3216523
10636-10051
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
10636-10051
Maybe
Security Only
4019113
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019113
4014982, 3216522, 2979577
10636-10378
Maybe
Monthly Rollup
4019110
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019110
10636-10378
Maybe
Security Only
4019113
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019113
4014982, 3216522, 2979577
10636-10379
Maybe
Monthly Rollup
4019110
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019110
10636-10379
Maybe
Security Only
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983, 3216521
10636-10481
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
10636-10481
Maybe
Security Only
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983, 3216521
10636-10482
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
10636-10482
Maybe
Security Only
4019114
4014983, 3216521
10636-10484
Maybe
Monthly Rollup
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983, 3216521
10636-10483
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
10636-10483
Maybe
Security Only
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983, 3216521
10636-10543
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
10636-10543
Maybe
Security Only
4019115
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019115
4014984, 3216520
10728-9312
Maybe
Monthly Rollup
4019109
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019109
3142037
10728-9312
Maybe
Security Only
4019115
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019115
4014984, 3216520
10728-9318
Maybe
Monthly Rollup
4019109
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019109
3142037
10728-9318
Maybe
Security Only
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10728-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10728-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10808-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10808-10788
Yes
Security Update
4019114
4014983
10900-10484
Maybe
Monthly Rollup
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981, 3216523
10807-10047
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
10807-10047
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981, 3216523
10807-10048
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
10807-10048
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981, 3216523
10807-10051
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
10807-10051
Maybe
Security Only
4019112
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019112
4014981, 3216523
10807-10049
Maybe
Monthly Rollup
4019108
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019108
10807-10049
Maybe
Security Only
4019113
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019113
4014982, 3216522
10807-10378
Maybe
Monthly Rollup
4019110
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019110
10807-10378
Maybe
Security Only
4019113
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019113
4014982, 3216522
10807-10379
Maybe
Monthly Rollup
4019110
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019110
10807-10379
Maybe
Security Only
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983, 3216521
10807-10483
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
10807-10483
Maybe
Security Only
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983, 3216521
10807-10543
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
10807-10543
Maybe
Security Only
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983, 3216521
10807-10481
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
10807-10481
Maybe
Security Only
4019114
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019114
4014983, 3216521
10807-10482
Maybe
Monthly Rollup
4019111
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019111
3164024
10807-10482
Maybe
Security Only
4019114
4014983, 3216521
10807-10484
Maybe
Monthly Rollup
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10957-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10957-10952
Yes
Security Update
Joonwoo Yu, Hyoung-Kee Choi of <a href="http://hit.skku.edu/~hkchoi/">Sungkyunkwan University</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Microsoft Office Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p>
<p>Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.</p>
<p>Note that the Preview Pane is not an attack vector for this vulnerability.</p>
<p>The security update addresses the vulnerability by correcting how Office handles objects in memory.</p>
<p>As of May 16, 2017, updates are available for Microsoft Office for Mac 2011 (3212221) and Microsoft Office 2016 for Mac. For more information, see <a href="https://support.microsoft.com/en-us/help/3212221">Microsoft Knowledge Base Article 3212221</a> and <a href="https://go.microsoft.com/fwlink/p/?linkid=831049">Release notes for Office 2016 for Mac</a>.</p>
Microsoft Office
CVE-2017-0254
1160
10162
10513
10514
10606
10604
10605
10746
10747
10521
10522
10734
4497
10024
10525
10608
999017
9432-10607
9432-10495
Remote Code Execution
1160
Remote Code Execution
10162
Remote Code Execution
10513
Remote Code Execution
10514
Remote Code Execution
10606
Remote Code Execution
10604
Remote Code Execution
10605
Remote Code Execution
10746
Remote Code Execution
10747
Remote Code Execution
10521
Remote Code Execution
10522
Remote Code Execution
10734
Remote Code Execution
4497
Remote Code Execution
10024
Remote Code Execution
10525
Remote Code Execution
10608
Remote Code Execution
999017
Remote Code Execution
9432-10607
Remote Code Execution
9432-10495
Important
1160
Important
10162
Important
10513
Important
10514
Important
10606
Important
10604
Important
10605
Important
10746
Important
10747
Important
10521
Important
10522
Important
10734
Important
4497
Important
10024
Important
10525
Important
10608
Important
999017
Important
9432-10607
Important
9432-10495
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
3191909
https://www.microsoft.com/downloads/details.aspx?familyid=992fe5fb-0c5d-4324-a6fc-781dfd326417
3178694
1160
Maybe
Security Update
3191836
https://www.microsoft.com/downloads/details.aspx?familyid=e4960ab4-e07e-40b7-857e-a25a40556919
3178683
10162
Maybe
Security Update
3191843
https://www.microsoft.com/downloads/details.aspx?familyid=0819e30d-65ff-421f-8ce1-a4ab518ae0a6
3178687
10513
Maybe
Security Update
3191841
https://www.microsoft.com/downloads/details.aspx?familyid=6affa3c9-6963-439b-96b3-c1061f676766
3178686
10513
Maybe
Security Update
3191843
https://www.microsoft.com/downloads/details.aspx?familyid=a8dcf48f-4a7f-4ad6-8744-aef38721fb6a
3178687
10514
Maybe
Security Update
3191841
https://www.microsoft.com/downloads/details.aspx?familyid=2c247a97-fba9-4b70-972c-efbf812ada50
3178686
10514
Maybe
Security Update
3178729
3172464
10606
Maybe
Security Update
3178729
https://www.microsoft.com/downloads/details.aspx?familyid=acdb2a53-9cfb-44d2-a4d6-d647cb9d9975
3172464
10604
Maybe
Security Update
3178729
https://www.microsoft.com/downloads/details.aspx?familyid=e42ade6c-0746-4054-8d66-be64d0b4695d
3172464
10605
Maybe
Security Update
3191865
https://www.microsoft.com/downloads/details.aspx?familyid=57718f1b-527f-4f7b-8163-b5b64b0ee70b
3178674
10746
Maybe
Security Update
3191865
https://www.microsoft.com/downloads/details.aspx?familyid=7ca94c93-746a-4e97-b6fd-e76b44d9e1c4
3178674
10747
Maybe
Security Update
3191841
https://www.microsoft.com/downloads/details.aspx?familyid=6affa3c9-6963-439b-96b3-c1061f676766
3178686
10521
Maybe
Security Update
3191841
https://www.microsoft.com/downloads/details.aspx?familyid=2c247a97-fba9-4b70-972c-efbf812ada50
3178686
10522
Maybe
Security Update
Release Notes
https://go.microsoft.com/fwlink/p/?linkid=831049
10734
No
Security Update
3191835
https://www.microsoft.com/downloads/details.aspx?familyid=4ed3b317-3c4d-418a-afd6-e1b497656e1c
3178682
4497
Maybe
Security Update
3212221
http://go.microsoft.com/fwlink/?LinkId=847738
10024
No
Security Update
3191904
https://www.microsoft.com/downloads/details.aspx?familyid=c7a5462c-44e2-4c80-9ff4-cb19ca275ad5
10525
Maybe
Security Update
3191888
https://www.microsoft.com/downloads/details.aspx?familyid=ee3effcf-0906-4ae3-940e-c406813bcd24
10608
Maybe
Security Update
3191880
https://www.microsoft.com/downloads/details.aspx?familyid=4e8bcbb7-e93d-423f-8e39-c9d5d8cc88f5
999017
Maybe
Security Update
3162040
https://www.microsoft.com/downloads/details.aspx?familyid=55475f7a-1114-4946-8095-07005781c3b6
3127927
9432-10607
Maybe
Security Update
3191839
https://www.microsoft.com/downloads/details.aspx?familyid=19c3be5d-9a37-42fe-a9aa-c374f2f00728
3178684
9432-10495
Maybe
Security Update
Yangkang(@dnpushme) & Liyadong & Wanglu of of <a href="http://www.360.cn/">360 QEX Team</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-16T07:00:00Z
<p>CVE information revised to announce the availability of the 14.7.4 update for Microsoft Office for Mac 2011 (3212221) and the 15.33.0 update for Microsoft Office 2016 for Mac. Customers running affected Mac software should install the appropriate update for their product to be protected from the vulnerability discussed in this CVE. Customers running other Microsoft Office software do not need to take any action. See <a href="https://support.microsoft.com/en-us/help/3212221">Microsoft Knowledge Base Article 3212221</a> and <a href="https://go.microsoft.com/fwlink/p/?linkid=831049">Release notes for Office 2016 for Mac</a> for more information and download links.</p>
Microsoft SharePoint Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.</p>
<p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p>
<p>The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests.</p>
Microsoft Office
CVE-2017-0255
10612
Elevation of Privilege
10612
Important
10612
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation Unlikely;DOS:N/A
3191914
https://www.microsoft.com/downloads/details.aspx?familyid=4cf230cf-bd83-4f25-9fd4-415d9ff09dd6
10612
Maybe
Security Update
Jörn Ahrens of <a href="https://www.volkswagenag.com/en.html">Volkswagen CERT-VW</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Windows Kernel Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.</p>
<p>To exploit this vulnerability, an authenticated attacker could run a specially crafted application. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p>
<p>The update addresses the vulnerability by correcting how the Windows kernel initializes objects in memory.</p>
Windows Kernel
CVE-2017-0258
10729
10735
10789
10788
10852
10853
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10855
10951
10952
10816
Information Disclosure
10729
Information Disclosure
10735
Information Disclosure
10789
Information Disclosure
10788
Information Disclosure
10852
Information Disclosure
10853
Information Disclosure
10047
Information Disclosure
10048
Information Disclosure
10481
Information Disclosure
10482
Information Disclosure
10484
Information Disclosure
9312
Information Disclosure
10287
Information Disclosure
9311
Information Disclosure
9318
Information Disclosure
9344
Information Disclosure
10050
Information Disclosure
10051
Information Disclosure
10049
Information Disclosure
10378
Information Disclosure
10379
Information Disclosure
10483
Information Disclosure
10543
Information Disclosure
10855
Information Disclosure
10951
Information Disclosure
10952
Information Disclosure
10816
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10855
Important
10951
Important
10952
Important
10816
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10729
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10735
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10789
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10788
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10852
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10853
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10047
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10048
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10481
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10482
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10484
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
9312
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10287
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
9311
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
9318
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
9344
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10050
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10051
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10049
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10378
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10379
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10483
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10543
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10855
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10951
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10952
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10816
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9312
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
10287
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9311
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9318
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
Mateusz Jurczyk of <a href="http://www.google.com">Google Project Zero</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows Kernel Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.</p>
<p>To exploit this vulnerability, an authenticated attacker could run a specially crafted application. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p>
<p>The update addresses the vulnerability by correcting how the Windows kernel initializes objects in memory.</p>
Windows Kernel
CVE-2017-0259
10729
10735
10789
10788
10852
10853
10481
10482
10484
10483
10543
10816
10951
10952
10855
Information Disclosure
10729
Information Disclosure
10735
Information Disclosure
10789
Information Disclosure
10788
Information Disclosure
10852
Information Disclosure
10853
Information Disclosure
10481
Information Disclosure
10482
Information Disclosure
10484
Information Disclosure
10483
Information Disclosure
10543
Information Disclosure
10816
Information Disclosure
10951
Information Disclosure
10952
Information Disclosure
10855
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10481
Important
10482
Important
10484
Important
10483
Important
10543
Important
10816
Important
10951
Important
10952
Important
10855
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10729
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10735
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10789
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10788
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10852
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10853
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10481
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10482
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10484
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10483
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10543
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10816
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10951
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10952
4.7
4.7
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
10855
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
Mateusz Jurczyk of <a href="http://www.google.com">Google Project Zero</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Microsoft Office Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft Office that could be exploited when a user opens a file containing a malformed graphics image or when a user inserts a malformed graphics image into an Office file. Such a file could also be included in an email attachment. An attacker could exploit the vulnerability by constructing a specially crafted EPS file that could allow remote code execution. An attacker who successfully exploited this vulnerability could take control of the affected system.</p>
<p>This vulnerability could not be exploited automatically through a Web-based attack scenario. An attacker could host a specially crafted website containing an Office file that is designed to exploit the vulnerability, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an instant messenger or email message that takes users to the attacker's website, or by getting them to open an attachment sent through email.</p>
<p>Workstations and terminal servers that have Microsoft Office installed are primarily at risk. Servers could be at more risk if administrators allow users to log on to servers and to run programs. However, best practices strongly discourage allowing this.</p>
<p>When this fix is published, Microsoft had received reports of limited targeted attacks using this vulnerability.</p>
Microsoft Office
CVE-2017-0261
10521
10522
10601
10602
10753
10754
Remote Code Execution
10521
Remote Code Execution
10522
Remote Code Execution
10601
Remote Code Execution
10602
Remote Code Execution
10753
Remote Code Execution
10754
Important
10521
Important
10522
Important
10601
Important
10602
Important
10753
Important
10754
Publicly Disclosed:No;Exploited:Yes;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation Detected
3118310
https://www.microsoft.com/downloads/details.aspx?familyid=0a53ce2e-8ddb-44e5-91ff-07c43cb01d3f
3114400
10521
Maybe
Security Update
3118310
https://www.microsoft.com/downloads/details.aspx?familyid=9946008d-a9a6-49a3-9dda-ac2f722a7da0
3114400
10522
Maybe
Security Update
3172458
https://www.microsoft.com/downloads/details.aspx?familyid=fead3a5e-cea1-4d8c-adef-2f3159dd887b
3114340
10601
Maybe
Security Update
3172458
https://www.microsoft.com/downloads/details.aspx?familyid=86a7312b-6017-4a6a-ab21-548ec62a6bdb
3114340
10602
Maybe
Security Update
3114375
https://www.microsoft.com/downloads/details.aspx?familyid=74822856-463c-4fec-9e60-f4f827deaa42
3085635
10753
Maybe
Security Update
3114375
https://www.microsoft.com/downloads/details.aspx?familyid=af56bea7-c217-4a7a-b091-93143b386bbc
3085635
10754
Maybe
Security Update
Genwei Jiang of <a href= "http://www.fireeye.com/">FireEye, Inc. </a>
Steven Hunter of MSRC Vulnerabilities & Mitigations
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Microsoft Office Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft Office that could be exploited when a user opens a file containing a malformed graphics image or when a user inserts a malformed graphics image into an Office file. Such a file could also be included in an email attachment. An attacker could exploit the vulnerability by constructing a specially crafted EPS file that could allow remote code execution. An attacker who successfully exploited this vulnerability could take control of the affected system.</p>
<p>This vulnerability could not be exploited automatically through a Web-based attack scenario. An attacker could host a specially crafted website containing an Office file that is designed to exploit the vulnerability, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an instant messenger or email message that takes users to the attacker's website, or by getting them to open an attachment sent through email.</p>
<p>Workstations and terminal servers that have Microsoft Office installed are primarily at risk. Servers could be at more risk if administrators allow users to log on to servers and to run programs. However, best practices strongly discourage allowing this.</p>
<p>When this fix is published, Microsoft had received reports of limited targeted attacks using this vulnerability.</p>
Microsoft Office
CVE-2017-0262
10521
10522
10603
10601
10602
10753
10754
Remote Code Execution
10521
Remote Code Execution
10522
Remote Code Execution
10603
Remote Code Execution
10601
Remote Code Execution
10602
Remote Code Execution
10753
Remote Code Execution
10754
Important
10521
Important
10522
Important
10603
Important
10601
Important
10602
Important
10753
Important
10754
Publicly Disclosed:No;Exploited:Yes;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation Detected
3118310
https://www.microsoft.com/downloads/details.aspx?familyid=0a53ce2e-8ddb-44e5-91ff-07c43cb01d3f
3114400
10521
Maybe
Security Update
3118310
https://www.microsoft.com/downloads/details.aspx?familyid=9946008d-a9a6-49a3-9dda-ac2f722a7da0
3114400
10522
Maybe
Security Update
3172458
3114340
10603
Maybe
Security Update
3172458
https://www.microsoft.com/downloads/details.aspx?familyid=fead3a5e-cea1-4d8c-adef-2f3159dd887b
3114340
10601
Maybe
Security Update
3172458
https://www.microsoft.com/downloads/details.aspx?familyid=86a7312b-6017-4a6a-ab21-548ec62a6bdb
3114340
10602
Maybe
Security Update
3114375
https://www.microsoft.com/downloads/details.aspx?familyid=74822856-463c-4fec-9e60-f4f827deaa42
3085635
10753
Maybe
Security Update
3114375
https://www.microsoft.com/downloads/details.aspx?familyid=af56bea7-c217-4a7a-b091-93143b386bbc
3085635
10754
Maybe
Security Update
Thomas Dupuy and Jessy Campos of <a href = "https://www.eset.com/us/"> ESET </a>
Genwei Jiang of <a href= "http://www.fireeye.com/">FireEye, Inc. </a>
1.1
2017-05-10T07:00:00Z
<p>Corrected Active Attack entry to Yes. When this information was originally released, Microsoft was aware of limited, targeted attacks that attempt to exploit this vulnerability.</p>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Win32k Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.</p>
<p>The update addresses this vulnerability by correcting how the Windows kernel-mode driver handles objects in memory.</p>
Windows Kernel-Mode Drivers
CVE-2017-0263
10729
10735
10789
10788
10852
10853
10951
10952
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
Elevation of Privilege
10729
Elevation of Privilege
10735
Elevation of Privilege
10789
Elevation of Privilege
10788
Elevation of Privilege
10852
Elevation of Privilege
10853
Elevation of Privilege
10951
Elevation of Privilege
10952
Elevation of Privilege
10047
Elevation of Privilege
10048
Elevation of Privilege
10481
Elevation of Privilege
10482
Elevation of Privilege
10484
Elevation of Privilege
9312
Elevation of Privilege
10287
Elevation of Privilege
9311
Elevation of Privilege
9318
Elevation of Privilege
9344
Elevation of Privilege
10050
Elevation of Privilege
10051
Elevation of Privilege
10049
Elevation of Privilege
10378
Elevation of Privilege
10379
Elevation of Privilege
10483
Elevation of Privilege
10543
Elevation of Privilege
10816
Elevation of Privilege
10855
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10951
Important
10952
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10816
Important
10855
Publicly Disclosed:No;Exploited:Yes
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10729
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10735
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10789
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10788
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10852
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10853
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10951
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10952
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10047
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10048
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10481
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10482
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10484
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9312
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10287
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9311
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9318
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9344
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10050
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10051
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10049
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10378
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10379
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10483
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10543
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10816
7.8
7.0
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10855
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
9312
Yes
Security Update
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
10287
Yes
Security Update
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
9311
Yes
Security Update
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
9318
Yes
Security Update
4019204
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019204
4012497
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
Mikhail Tsvetkov of <a href="https://www.ptsecurity.com">Positive Technologies</a>
Dhanesh Kizhakkinan of <a href="https://www.fireeye.com/">FireEye Inc</a>
Thomas Dupuy and Jessy Campos of <a href = "https://www.eset.com/us/"> ESET </a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Microsoft Malware Protection Engine Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine. There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim's system that is scanned when the website is viewed by the user. An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server.</p>
<p>If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file is scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited. All systems running an affected version of antimalware software are primarily at risk.</p>
<p>The update addresses the vulnerability by correcting the manner in which the Microsoft Malware Protection Engine scans specially crafted files.</p>
<p>Note: Typically, no action is required of enterprise administrators or end users to install updates for the Microsoft Malware Protection Engine, because the built-in mechanism for the automatic detection and deployment of updates will apply the update within 48 hours of release. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<table>
<thead>
<tr>
<th>References</th>
<th>Identification</th>
</tr>
</thead>
<tbody>
<tr>
<td>Last version of the Microsoft Malware Protection Engine affected by this vulnerability</td>
<td>Version 1.1.13701.0</td>
</tr>
<tr>
<td>First version of the Microsoft Malware Protection Engine with this vulnerability addressed</td>
<td>Version 1.1.13704.0</td>
</tr>
</tbody>
</table>
<p><strong>Why is no action required to install this update?</strong>
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.</p>
<p>For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.</p>
<p>Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.</p>
<p><strong>How often are the Microsoft Malware Protection Engine and malware definitions updated?</strong>
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.</p>
<p>Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.</p>
<p><strong>What is the Microsoft Malware Protection Engine?</strong>
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software.</p>
<p><strong>Does this update contain any additional security-related changes to functionality?</strong>
Yes. In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.</p>
<p><strong>Where can I find more information about Microsoft antimalware technology?</strong>
For more information, visit the <a href="https://www.microsoft.com/security/portal/">Microsoft Malware Protection Center</a>Â website.</p>
<p><strong>Suggested Actions</strong>
<strong>Verify that the update is installed</strong>
Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products.</p>
<p>For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
<p>For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.13704.0 or later.</p>
<p><strong>If necessary, install the update</strong>
Administrators of enterprise antimalware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.</p>
<p>For end-users, the affected software provides built-in mechanisms for the automatic detection and deployment of this update. For these customers, the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<p>End users that do not wish to wait can manually update their antimalware software.</p>
<p>For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
Microsoft Malware Protection Engine
CVE-2017-0290
10010
10013
10334
11431
251-10951
251-10952
251-10729
251-10735
251-10789
251-10788
251-10852
251-10853
251-10816
251-10855
251-10047
251-10048
251-10481
251-10482
251-10484
Remote Code Execution
10010
Remote Code Execution
10013
Remote Code Execution
10334
Remote Code Execution
11431
Remote Code Execution
251-10951
Remote Code Execution
251-10952
Remote Code Execution
251-10729
Remote Code Execution
251-10735
Remote Code Execution
251-10789
Remote Code Execution
251-10788
Remote Code Execution
251-10852
Remote Code Execution
251-10853
Remote Code Execution
251-10816
Remote Code Execution
251-10855
Remote Code Execution
251-10047
Remote Code Execution
251-10048
Remote Code Execution
251-10481
Remote Code Execution
251-10482
Remote Code Execution
251-10484
Critical
10010
Critical
10013
Critical
10334
Critical
11431
Critical
251-10951
Critical
251-10952
Critical
251-10729
Critical
251-10735
Critical
251-10789
Critical
251-10788
Critical
251-10852
Critical
251-10853
Critical
251-10816
Critical
251-10855
Critical
251-10047
Critical
251-10048
Critical
251-10481
Critical
251-10482
Critical
251-10484
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
Natalie Silvanovich and Tavis Ormandy of <a href ="http://www.google.com/">Google Project Zero</a>
1.0
2017-05-08T07:00:00Z
<p>Information published.</p>
1.1
2017-08-29T07:00:00Z
<p>Corrected version reference in FAQ. This is an informational change only.</p>
Microsoft Malware Protection Engine Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine. There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim's system that is scanned when the website is viewed by the user. An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server.</p>
<p>If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file is scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited. All systems running an affected version of antimalware software are primarily at risk.</p>
<p>The update addresses the vulnerability by correcting the manner in which the Microsoft Malware Protection Engine scans specially crafted files.</p>
<p>Note: Typically, no action is required of enterprise administrators or end users to install updates for the Microsoft Malware Protection Engine, because the built-in mechanism for the automatic detection and deployment of updates will apply the update within 48 hours of release. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<table>
<thead>
<tr>
<th>References</th>
<th>Identification</th>
</tr>
</thead>
<tbody>
<tr>
<td>Last version of the Microsoft Malware Protection Engine affected by this vulnerability</td>
<td>Version 1.1.13701.0</td>
</tr>
<tr>
<td>First version of the Microsoft Malware Protection Engine with this vulnerability addressed</td>
<td>Version 1.1.13704.0</td>
</tr>
</tbody>
</table>
<p><strong>Why is no action required to install this update?</strong>
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.</p>
<p>For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.</p>
<p>Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.</p>
<p><strong>How often are the Microsoft Malware Protection Engine and malware definitions updated?</strong>
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.</p>
<p>Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.</p>
<p><strong>What is the Microsoft Malware Protection Engine?</strong>
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software.</p>
<p><strong>Does this update contain any additional security-related changes to functionality?</strong>
Yes. In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.</p>
<p><strong>Where can I find more information about Microsoft antimalware technology?</strong>
For more information, visit the <a href="https://www.microsoft.com/security/portal/">Microsoft Malware Protection Center</a>Â website.</p>
<p><strong>Suggested Actions</strong>
<strong>Verify that the update is installed</strong>
Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products.</p>
<p>For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
<p>For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.13704.0 or later.</p>
<p><strong>If necessary, install the update</strong>
Administrators of enterprise antimalware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.</p>
<p>For end-users, the affected software provides built-in mechanisms for the automatic detection and deployment of this update. For these customers, the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<p>End users that do not wish to wait can manually update their antimalware software.</p>
<p>For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
Microsoft Malware Protection Engine
CVE-2017-8538
11431
10330
10013
10334
11430
11432
10804
10431
251-10951
251-10952
251-10729
251-10735
251-10789
251-10788
251-10852
251-10853
251-10816
251-10855
251-10047
251-10048
251-10481
251-10482
251-10484
251-10050
251-10051
251-10049
Remote Code Execution
11431
Remote Code Execution
10330
Remote Code Execution
10013
Remote Code Execution
10334
Remote Code Execution
11430
Remote Code Execution
11432
Remote Code Execution
10804
Remote Code Execution
10431
Remote Code Execution
251-10951
Remote Code Execution
251-10952
Remote Code Execution
251-10729
Remote Code Execution
251-10735
Remote Code Execution
251-10789
Remote Code Execution
251-10788
Remote Code Execution
251-10852
Remote Code Execution
251-10853
Remote Code Execution
251-10816
Remote Code Execution
251-10855
Remote Code Execution
251-10047
Remote Code Execution
251-10048
Remote Code Execution
251-10481
Remote Code Execution
251-10482
Remote Code Execution
251-10484
Remote Code Execution
251-10050
Remote Code Execution
251-10051
Remote Code Execution
251-10049
Critical
11431
Critical
10330
Critical
10013
Critical
10334
Critical
11430
Critical
11432
Critical
10804
Critical
10431
Critical
251-10951
Critical
251-10952
Critical
251-10729
Critical
251-10735
Critical
251-10789
Critical
251-10788
Critical
251-10852
Critical
251-10853
Critical
251-10816
Critical
251-10855
Critical
251-10047
Critical
251-10048
Critical
251-10481
Critical
251-10482
Critical
251-10484
Critical
251-10050
Critical
251-10051
Critical
251-10049
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
<p>The following <a href="https://technet.microsoft.com/library/security/dn848375.aspx">mitigating factors</a> may be helpful in your situation:
Systems running supported versions of Windows Server 2008 R2 are not affected if the Desktop Experience feature is not installed.</p>
Mateusz Jurczyk of <a href ="http://www.google.com/">Google Project Zero</a>
1.0
2017-05-25T07:00:00Z
<p>Information published.</p>
Microsoft Malware Protection Engine Denial of Service Vulnerability
<p>A denial of service vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to a scan timeout. An attacker who successfully exploited this vulnerability could prevent the Microsoft Malware Protection Engine from monitoring affected systems until the service is restarted.
To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine. There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim's system that is scanned when the website is viewed by the user. An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server.</p>
<p>If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file is scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited. All systems running an affected version of antimalware software are primarily at risk.</p>
<p>The update addresses the vulnerability by correcting how the Microsoft Malware Protection Engine scans specially crafted files.</p>
<p>Note: Typically, no action is required of enterprise administrators or end users to install updates for the Microsoft Malware Protection Engine, because the built-in mechanism for the automatic detection and deployment of updates will apply the update within 48 hours of release. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<table>
<thead>
<tr>
<th>References</th>
<th>Identification</th>
</tr>
</thead>
<tbody>
<tr>
<td>Last version of the Microsoft Malware Protection Engine affected by this vulnerability</td>
<td>Version 1.1.13701.0</td>
</tr>
<tr>
<td>First version of the Microsoft Malware Protection Engine with this vulnerability addressed</td>
<td>Version 1.1.13704.0</td>
</tr>
</tbody>
</table>
<p><strong>Why is no action required to install this update?</strong>
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.</p>
<p>For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.</p>
<p>Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.</p>
<p><strong>How often are the Microsoft Malware Protection Engine and malware definitions updated?</strong>
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.</p>
<p>Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.</p>
<p><strong>What is the Microsoft Malware Protection Engine?</strong>
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software.</p>
<p><strong>Does this update contain any additional security-related changes to functionality?</strong>
Yes. In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.</p>
<p><strong>Where can I find more information about Microsoft antimalware technology?</strong>
For more information, visit the <a href="https://www.microsoft.com/security/portal/">Microsoft Malware Protection Center</a>Â website.</p>
<p><strong>Suggested Actions</strong>
<strong>Verify that the update is installed</strong>
Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products.</p>
<p>For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
<p>For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.13704.0 or later.</p>
<p><strong>If necessary, install the update</strong>
Administrators of enterprise antimalware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.</p>
<p>For end-users, the affected software provides built-in mechanisms for the automatic detection and deployment of this update. For these customers, the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<p>End users that do not wish to wait can manually update their antimalware software.</p>
<p>For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
Microsoft Malware Protection Engine
CVE-2017-8535
11430
11431
11432
10804
10431
10330
10013
10334
251-10951
251-10952
251-10729
251-10735
251-10789
251-10788
251-10852
251-10853
251-10816
251-10855
251-10047
251-10048
251-10481
251-10482
251-10484
251-10050
251-10051
251-10049
Denial of Service
11430
Denial of Service
11431
Denial of Service
11432
Denial of Service
10804
Denial of Service
10431
Denial of Service
10330
Denial of Service
10013
Denial of Service
10334
Denial of Service
251-10951
Denial of Service
251-10952
Denial of Service
251-10729
Denial of Service
251-10735
Denial of Service
251-10789
Denial of Service
251-10788
Denial of Service
251-10852
Denial of Service
251-10853
Denial of Service
251-10816
Denial of Service
251-10855
Denial of Service
251-10047
Denial of Service
251-10048
Denial of Service
251-10481
Denial of Service
251-10482
Denial of Service
251-10484
Denial of Service
251-10050
Denial of Service
251-10051
Denial of Service
251-10049
Important
11430
Important
11431
Important
11432
Important
10804
Important
10431
Important
10330
Important
10013
Important
10334
Important
251-10951
Important
251-10952
Important
251-10729
Important
251-10735
Important
251-10789
Important
251-10788
Important
251-10852
Important
251-10853
Important
251-10816
Important
251-10855
Important
251-10047
Important
251-10048
Important
251-10481
Important
251-10482
Important
251-10484
Important
251-10050
Important
251-10051
Important
251-10049
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
<p>The following <a href="https://technet.microsoft.com/library/security/dn848375.aspx">mitigating factors</a> may be helpful in your situation:
Systems running supported versions of Windows Server 2008 R2 are not affected if the Desktop Experience feature is not installed.</p>
Mateusz Jurczyk of <a href ="http://www.google.com/">Google Project Zero</a>
1.0
2017-05-25T07:00:00Z
<p>Information published.</p>
Microsoft Malware Protection Engine Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine. There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim's system that is scanned when the website is viewed by the user. An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server.</p>
<p>If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file is scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited. All systems running an affected version of antimalware software are primarily at risk.</p>
<p>The update addresses the vulnerability by correcting the manner in which the Microsoft Malware Protection Engine scans specially crafted files.</p>
<p>Note: Typically, no action is required of enterprise administrators or end users to install updates for the Microsoft Malware Protection Engine, because the built-in mechanism for the automatic detection and deployment of updates will apply the update within 48 hours of release. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<table>
<thead>
<tr>
<th>References</th>
<th>Identification</th>
</tr>
</thead>
<tbody>
<tr>
<td>Last version of the Microsoft Malware Protection Engine affected by this vulnerability</td>
<td>Version 1.1.13701.0</td>
</tr>
<tr>
<td>First version of the Microsoft Malware Protection Engine with this vulnerability addressed</td>
<td>Version 1.1.13704.0</td>
</tr>
</tbody>
</table>
<p><strong>Why is no action required to install this update?</strong>
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.</p>
<p>For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.</p>
<p>Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.</p>
<p><strong>How often are the Microsoft Malware Protection Engine and malware definitions updated?</strong>
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.</p>
<p>Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.</p>
<p><strong>What is the Microsoft Malware Protection Engine?</strong>
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software.</p>
<p><strong>Does this update contain any additional security-related changes to functionality?</strong>
Yes. In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.</p>
<p><strong>Where can I find more information about Microsoft antimalware technology?</strong>
For more information, visit the <a href="https://www.microsoft.com/security/portal/">Microsoft Malware Protection Center</a>Â website.</p>
<p><strong>Suggested Actions</strong>
<strong>Verify that the update is installed</strong>
Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products.</p>
<p>For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
<p>For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.13704.0 or later.</p>
<p><strong>If necessary, install the update</strong>
Administrators of enterprise antimalware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.</p>
<p>For end-users, the affected software provides built-in mechanisms for the automatic detection and deployment of this update. For these customers, the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<p>End users that do not wish to wait can manually update their antimalware software.</p>
<p>For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
Microsoft Malware Protection Engine
CVE-2017-8540
11431
10330
10013
10334
11430
11432
10804
10431
251-10951
251-10952
251-10729
251-10735
251-10789
251-10788
251-10852
251-10853
251-10816
251-10855
251-10047
251-10048
251-10481
251-10482
251-10484
251-10050
251-10051
251-10049
Remote Code Execution
11431
Remote Code Execution
10330
Remote Code Execution
10013
Remote Code Execution
10334
Remote Code Execution
11430
Remote Code Execution
11432
Remote Code Execution
10804
Remote Code Execution
10431
Remote Code Execution
251-10951
Remote Code Execution
251-10952
Remote Code Execution
251-10729
Remote Code Execution
251-10735
Remote Code Execution
251-10789
Remote Code Execution
251-10788
Remote Code Execution
251-10852
Remote Code Execution
251-10853
Remote Code Execution
251-10816
Remote Code Execution
251-10855
Remote Code Execution
251-10047
Remote Code Execution
251-10048
Remote Code Execution
251-10481
Remote Code Execution
251-10482
Remote Code Execution
251-10484
Remote Code Execution
251-10050
Remote Code Execution
251-10051
Remote Code Execution
251-10049
Critical
11431
Critical
10330
Critical
10013
Critical
10334
Critical
11430
Critical
11432
Critical
10804
Critical
10431
Critical
251-10951
Critical
251-10952
Critical
251-10729
Critical
251-10735
Critical
251-10789
Critical
251-10788
Critical
251-10852
Critical
251-10853
Critical
251-10816
Critical
251-10855
Critical
251-10047
Critical
251-10048
Critical
251-10481
Critical
251-10482
Critical
251-10484
Critical
251-10050
Critical
251-10051
Critical
251-10049
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
<p>The following <a href="https://technet.microsoft.com/library/security/dn848375.aspx">mitigating factors</a> may be helpful in your situation:
Systems running supported versions of Windows Server 2008 R2 are not affected if the Desktop Experience feature is not installed.</p>
Ian Beer of <a href ="http://www.google.com/">Google Project Zero</a>
1.0
2017-05-25T07:00:00Z
<p>Information published.</p>
Microsoft Malware Protection Engine Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine. There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim's system that is scanned when the website is viewed by the user. An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server.</p>
<p>If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file is scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited. All systems running an affected version of antimalware software are primarily at risk.</p>
<p>The update addresses the vulnerability by correcting the manner in which the Microsoft Malware Protection Engine scans specially crafted files.</p>
<p>Note: Typically, no action is required of enterprise administrators or end users to install updates for the Microsoft Malware Protection Engine, because the built-in mechanism for the automatic detection and deployment of updates will apply the update within 48 hours of release. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<table>
<thead>
<tr>
<th>References</th>
<th>Identification</th>
</tr>
</thead>
<tbody>
<tr>
<td>Last version of the Microsoft Malware Protection Engine affected by this vulnerability</td>
<td>Version 1.1.13701.0</td>
</tr>
<tr>
<td>First version of the Microsoft Malware Protection Engine with this vulnerability addressed</td>
<td>Version 1.1.13704.0</td>
</tr>
</tbody>
</table>
<p><strong>Why is no action required to install this update?</strong>
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.</p>
<p>For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.</p>
<p>Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.</p>
<p><strong>How often are the Microsoft Malware Protection Engine and malware definitions updated?</strong>
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.</p>
<p>Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.</p>
<p><strong>What is the Microsoft Malware Protection Engine?</strong>
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software.</p>
<p><strong>Does this update contain any additional security-related changes to functionality?</strong>
Yes. In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.</p>
<p><strong>Where can I find more information about Microsoft antimalware technology?</strong>
For more information, visit the <a href="https://www.microsoft.com/security/portal/">Microsoft Malware Protection Center</a>Â website.</p>
<p><strong>Suggested Actions</strong>
<strong>Verify that the update is installed</strong>
Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products.</p>
<p>For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
<p>For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.13704.0 or later.</p>
<p><strong>If necessary, install the update</strong>
Administrators of enterprise antimalware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.</p>
<p>For end-users, the affected software provides built-in mechanisms for the automatic detection and deployment of this update. For these customers, the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<p>End users that do not wish to wait can manually update their antimalware software.</p>
<p>For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
Microsoft Malware Protection Engine
CVE-2017-8541
11431
10330
10013
10334
11430
11432
10804
10431
251-10951
251-10952
251-10729
251-10735
251-10789
251-10788
251-10852
251-10853
251-10816
251-10855
251-10047
251-10048
251-10481
251-10482
251-10484
251-10050
251-10051
251-10049
Remote Code Execution
11431
Remote Code Execution
10330
Remote Code Execution
10013
Remote Code Execution
10334
Remote Code Execution
11430
Remote Code Execution
11432
Remote Code Execution
10804
Remote Code Execution
10431
Remote Code Execution
251-10951
Remote Code Execution
251-10952
Remote Code Execution
251-10729
Remote Code Execution
251-10735
Remote Code Execution
251-10789
Remote Code Execution
251-10788
Remote Code Execution
251-10852
Remote Code Execution
251-10853
Remote Code Execution
251-10816
Remote Code Execution
251-10855
Remote Code Execution
251-10047
Remote Code Execution
251-10048
Remote Code Execution
251-10481
Remote Code Execution
251-10482
Remote Code Execution
251-10484
Remote Code Execution
251-10050
Remote Code Execution
251-10051
Remote Code Execution
251-10049
Critical
11431
Critical
10330
Critical
10013
Critical
10334
Critical
11430
Critical
11432
Critical
10804
Critical
10431
Critical
251-10951
Critical
251-10952
Critical
251-10729
Critical
251-10735
Critical
251-10789
Critical
251-10788
Critical
251-10852
Critical
251-10853
Critical
251-10816
Critical
251-10855
Critical
251-10047
Critical
251-10048
Critical
251-10481
Critical
251-10482
Critical
251-10484
Critical
251-10050
Critical
251-10051
Critical
251-10049
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
<p>The following <a href="https://technet.microsoft.com/library/security/dn848375.aspx">mitigating factors</a> may be helpful in your situation:
Systems running supported versions of Windows Server 2008 R2 are not affected if the Desktop Experience feature is not installed.</p>
Lokihardt of <a href="https://www.google.com/">Google Project Zero</a>
1.0
2017-05-25T07:00:00Z
<p>Information published.</p>
Microsoft Malware Protection Engine Denial of Service Vulnerability
<p>A denial of service vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to a scan timeout. An attacker who successfully exploited this vulnerability could prevent the Microsoft Malware Protection Engine from monitoring affected systems until the service is restarted.
To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine. There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim's system that is scanned when the website is viewed by the user. An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server.</p>
<p>If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file is scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited. All systems running an affected version of antimalware software are primarily at risk.</p>
<p>The update addresses the vulnerability by correcting how the Microsoft Malware Protection Engine scans specially crafted files.</p>
<p>Note: Typically, no action is required of enterprise administrators or end users to install updates for the Microsoft Malware Protection Engine, because the built-in mechanism for the automatic detection and deployment of updates will apply the update within 48 hours of release. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<table>
<thead>
<tr>
<th>References</th>
<th>Identification</th>
</tr>
</thead>
<tbody>
<tr>
<td>Last version of the Microsoft Malware Protection Engine affected by this vulnerability</td>
<td>Version 1.1.13701.0</td>
</tr>
<tr>
<td>First version of the Microsoft Malware Protection Engine with this vulnerability addressed</td>
<td>Version 1.1.13704.0</td>
</tr>
</tbody>
</table>
<p><strong>Why is no action required to install this update?</strong>
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.</p>
<p>For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.</p>
<p>Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.</p>
<p><strong>How often are the Microsoft Malware Protection Engine and malware definitions updated?</strong>
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.</p>
<p>Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.</p>
<p><strong>What is the Microsoft Malware Protection Engine?</strong>
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software.</p>
<p><strong>Does this update contain any additional security-related changes to functionality?</strong>
Yes. In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.</p>
<p><strong>Where can I find more information about Microsoft antimalware technology?</strong>
For more information, visit the <a href="https://www.microsoft.com/security/portal/">Microsoft Malware Protection Center</a>Â website.</p>
<p><strong>Suggested Actions</strong>
<strong>Verify that the update is installed</strong>
Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products.</p>
<p>For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
<p>For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.13704.0 or later.</p>
<p><strong>If necessary, install the update</strong>
Administrators of enterprise antimalware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.</p>
<p>For end-users, the affected software provides built-in mechanisms for the automatic detection and deployment of this update. For these customers, the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<p>End users that do not wish to wait can manually update their antimalware software.</p>
<p>For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
Microsoft Malware Protection Engine
CVE-2017-8542
11431
10330
10013
10334
11430
11432
10804
10431
251-10951
251-10952
251-10729
251-10735
251-10789
251-10788
251-10852
251-10853
251-10816
251-10855
251-10047
251-10048
251-10481
251-10482
251-10484
251-10050
251-10051
251-10049
Denial of Service
11431
Denial of Service
10330
Denial of Service
10013
Denial of Service
10334
Denial of Service
11430
Denial of Service
11432
Denial of Service
10804
Denial of Service
10431
Denial of Service
251-10951
Denial of Service
251-10952
Denial of Service
251-10729
Denial of Service
251-10735
Denial of Service
251-10789
Denial of Service
251-10788
Denial of Service
251-10852
Denial of Service
251-10853
Denial of Service
251-10816
Denial of Service
251-10855
Denial of Service
251-10047
Denial of Service
251-10048
Denial of Service
251-10481
Denial of Service
251-10482
Denial of Service
251-10484
Denial of Service
251-10050
Denial of Service
251-10051
Denial of Service
251-10049
Important
11431
Important
10330
Important
10013
Important
10334
Important
11430
Important
11432
Important
10804
Important
10431
Important
251-10951
Important
251-10952
Important
251-10729
Important
251-10735
Important
251-10789
Important
251-10788
Important
251-10852
Important
251-10853
Important
251-10816
Important
251-10855
Important
251-10047
Important
251-10048
Important
251-10481
Important
251-10482
Important
251-10484
Important
251-10050
Important
251-10051
Important
251-10049
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
<p>The following <a href="https://technet.microsoft.com/library/security/dn848375.aspx">mitigating factors</a> may be helpful in your situation:
Systems running supported versions of Windows Server 2008 R2 are not affected if the Desktop Experience feature is not installed.</p>
Tavis Ormandy of <a href ="http://www.google.com/">Google Project Zero</a>
1.0
2017-05-25T07:00:00Z
<p>Information published.</p>
Microsoft Malware Protection Engine Denial of Service Vulnerability
<p>A denial of service vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to a scan timeout. An attacker who successfully exploited this vulnerability could prevent the Microsoft Malware Protection Engine from monitoring affected systems until the service is restarted.
To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine. There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim's system that is scanned when the website is viewed by the user. An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server.</p>
<p>If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file is scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited. All systems running an affected version of antimalware software are primarily at risk.</p>
<p>The update addresses the vulnerability by correcting how the Microsoft Malware Protection Engine scans specially crafted files.</p>
<p>Note: Typically, no action is required of enterprise administrators or end users to install updates for the Microsoft Malware Protection Engine, because the built-in mechanism for the automatic detection and deployment of updates will apply the update within 48 hours of release. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<table>
<thead>
<tr>
<th>References</th>
<th>Identification</th>
</tr>
</thead>
<tbody>
<tr>
<td>Last version of the Microsoft Malware Protection Engine affected by this vulnerability</td>
<td>Version 1.1.13701.0</td>
</tr>
<tr>
<td>First version of the Microsoft Malware Protection Engine with this vulnerability addressed</td>
<td>Version 1.1.13704.0</td>
</tr>
</tbody>
</table>
<p><strong>Why is no action required to install this update?</strong>
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.</p>
<p>For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.</p>
<p>Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.</p>
<p><strong>How often are the Microsoft Malware Protection Engine and malware definitions updated?</strong>
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.</p>
<p>Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.</p>
<p><strong>What is the Microsoft Malware Protection Engine?</strong>
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software.</p>
<p><strong>Does this update contain any additional security-related changes to functionality?</strong>
Yes. In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.</p>
<p><strong>Where can I find more information about Microsoft antimalware technology?</strong>
For more information, visit the <a href="https://www.microsoft.com/security/portal/">Microsoft Malware Protection Center</a>Â website.</p>
<p><strong>Suggested Actions</strong>
<strong>Verify that the update is installed</strong>
Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products.</p>
<p>For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
<p>For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.13704.0 or later.</p>
<p><strong>If necessary, install the update</strong>
Administrators of enterprise antimalware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.</p>
<p>For end-users, the affected software provides built-in mechanisms for the automatic detection and deployment of this update. For these customers, the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<p>End users that do not wish to wait can manually update their antimalware software.</p>
<p>For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
Microsoft Malware Protection Engine
CVE-2017-8536
11431
10330
10013
10334
11430
11432
10804
10431
251-10951
251-10952
251-10729
251-10735
251-10789
251-10788
251-10852
251-10853
251-10816
251-10855
251-10047
251-10048
251-10481
251-10482
251-10484
251-10050
251-10051
251-10049
Denial of Service
11431
Denial of Service
10330
Denial of Service
10013
Denial of Service
10334
Denial of Service
11430
Denial of Service
11432
Denial of Service
10804
Denial of Service
10431
Denial of Service
251-10951
Denial of Service
251-10952
Denial of Service
251-10729
Denial of Service
251-10735
Denial of Service
251-10789
Denial of Service
251-10788
Denial of Service
251-10852
Denial of Service
251-10853
Denial of Service
251-10816
Denial of Service
251-10855
Denial of Service
251-10047
Denial of Service
251-10048
Denial of Service
251-10481
Denial of Service
251-10482
Denial of Service
251-10484
Denial of Service
251-10050
Denial of Service
251-10051
Denial of Service
251-10049
Important
11431
Important
10330
Important
10013
Important
10334
Important
11430
Important
11432
Important
10804
Important
10431
Important
251-10951
Important
251-10952
Important
251-10729
Important
251-10735
Important
251-10789
Important
251-10788
Important
251-10852
Important
251-10853
Important
251-10816
Important
251-10855
Important
251-10047
Important
251-10048
Important
251-10481
Important
251-10482
Important
251-10484
Important
251-10050
Important
251-10051
Important
251-10049
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
<p>The following <a href="https://technet.microsoft.com/library/security/dn848375.aspx">mitigating factors</a> may be helpful in your situation:
Systems running supported versions of Windows Server 2008 R2 are not affected if the Desktop Experience feature is not installed.</p>
Mateusz Jurczyk of <a href ="http://www.google.com/">Google Project Zero</a>
1.0
2017-05-25T07:00:00Z
<p>Information published.</p>
Microsoft Malware Protection Engine Denial of Service Vulnerability
<p>A denial of service vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to a scan timeout. An attacker who successfully exploited this vulnerability could prevent the Microsoft Malware Protection Engine from monitoring affected systems until the service is restarted.
To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine. There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim's system that is scanned when the website is viewed by the user. An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server.</p>
<p>If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file is scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited. All systems running an affected version of antimalware software are primarily at risk.</p>
<p>The update addresses the vulnerability by correcting how the Microsoft Malware Protection Engine scans specially crafted files.</p>
<p>Note: Typically, no action is required of enterprise administrators or end users to install updates for the Microsoft Malware Protection Engine, because the built-in mechanism for the automatic detection and deployment of updates will apply the update within 48 hours of release. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<table>
<thead>
<tr>
<th>References</th>
<th>Identification</th>
</tr>
</thead>
<tbody>
<tr>
<td>Last version of the Microsoft Malware Protection Engine affected by this vulnerability</td>
<td>Version 1.1.13701.0</td>
</tr>
<tr>
<td>First version of the Microsoft Malware Protection Engine with this vulnerability addressed</td>
<td>Version 1.1.13704.0</td>
</tr>
</tbody>
</table>
<p><strong>Why is no action required to install this update?</strong>
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.</p>
<p>For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.</p>
<p>Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.</p>
<p><strong>How often are the Microsoft Malware Protection Engine and malware definitions updated?</strong>
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.</p>
<p>Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.</p>
<p><strong>What is the Microsoft Malware Protection Engine?</strong>
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software.</p>
<p><strong>Does this update contain any additional security-related changes to functionality?</strong>
Yes. In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.</p>
<p><strong>Where can I find more information about Microsoft antimalware technology?</strong>
For more information, visit the <a href="https://www.microsoft.com/security/portal/">Microsoft Malware Protection Center</a>Â website.</p>
<p><strong>Suggested Actions</strong>
<strong>Verify that the update is installed</strong>
Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products.</p>
<p>For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
<p>For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.13704.0 or later.</p>
<p><strong>If necessary, install the update</strong>
Administrators of enterprise antimalware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.</p>
<p>For end-users, the affected software provides built-in mechanisms for the automatic detection and deployment of this update. For these customers, the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<p>End users that do not wish to wait can manually update their antimalware software.</p>
<p>For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
Microsoft Malware Protection Engine
CVE-2017-8537
11431
10330
10013
10334
11430
11432
10804
10431
251-10951
251-10952
251-10729
251-10735
251-10789
251-10788
251-10852
251-10853
251-10816
251-10855
251-10047
251-10048
251-10481
251-10482
251-10484
251-10050
251-10051
251-10049
Denial of Service
11431
Denial of Service
10330
Denial of Service
10013
Denial of Service
10334
Denial of Service
11430
Denial of Service
11432
Denial of Service
10804
Denial of Service
10431
Denial of Service
251-10951
Denial of Service
251-10952
Denial of Service
251-10729
Denial of Service
251-10735
Denial of Service
251-10789
Denial of Service
251-10788
Denial of Service
251-10852
Denial of Service
251-10853
Denial of Service
251-10816
Denial of Service
251-10855
Denial of Service
251-10047
Denial of Service
251-10048
Denial of Service
251-10481
Denial of Service
251-10482
Denial of Service
251-10484
Denial of Service
251-10050
Denial of Service
251-10051
Denial of Service
251-10049
Important
11431
Important
10330
Important
10013
Important
10334
Important
11430
Important
11432
Important
10804
Important
10431
Important
251-10951
Important
251-10952
Important
251-10729
Important
251-10735
Important
251-10789
Important
251-10788
Important
251-10852
Important
251-10853
Important
251-10816
Important
251-10855
Important
251-10047
Important
251-10048
Important
251-10481
Important
251-10482
Important
251-10484
Important
251-10050
Important
251-10051
Important
251-10049
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
<p>The following <a href="https://technet.microsoft.com/library/security/dn848375.aspx">mitigating factors</a> may be helpful in your situation:
Systems running supported versions of Windows Server 2008 R2 are not affected if the Desktop Experience feature is not installed.</p>
Mateusz Jurczyk of <a href ="http://www.google.com/">Google Project Zero</a>
1.0
2017-05-25T07:00:00Z
<p>Information published.</p>
Microsoft Malware Protection Engine Denial of Service Vulnerability
<p>A denial of service vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to a scan timeout. An attacker who successfully exploited this vulnerability could prevent the Microsoft Malware Protection Engine from monitoring affected systems until the service is restarted.
To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine. There are many ways that an attacker could place a specially crafted file in a location that is scanned by the Microsoft Malware Protection Engine. For example, an attacker could use a website to deliver a specially crafted file to the victim's system that is scanned when the website is viewed by the user. An attacker could also deliver a specially crafted file via an email message or in an Instant Messenger message that is scanned when the file is opened. In addition, an attacker could take advantage of websites that accept or host user-provided content, to upload a specially crafted file to a shared location that is scanned by the Malware Protection Engine running on the hosting server.</p>
<p>If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file is scanned. If real-time scanning is not enabled, the attacker would need to wait until a scheduled scan occurs in order for the vulnerability to be exploited. All systems running an affected version of antimalware software are primarily at risk.</p>
<p>The update addresses the vulnerability by correcting how the Microsoft Malware Protection Engine scans specially crafted files.</p>
<p>Note: Typically, no action is required of enterprise administrators or end users to install updates for the Microsoft Malware Protection Engine, because the built-in mechanism for the automatic detection and deployment of updates will apply the update within 48 hours of release. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<table>
<thead>
<tr>
<th>References</th>
<th>Identification</th>
</tr>
</thead>
<tbody>
<tr>
<td>Last version of the Microsoft Malware Protection Engine affected by this vulnerability</td>
<td>Version 1.1.13701.0</td>
</tr>
<tr>
<td>First version of the Microsoft Malware Protection Engine with this vulnerability addressed</td>
<td>Version 1.1.13704.0</td>
</tr>
</tbody>
</table>
<p><strong>Why is no action required to install this update?</strong>
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.</p>
<p>For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.</p>
<p>Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.</p>
<p><strong>How often are the Microsoft Malware Protection Engine and malware definitions updated?</strong>
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.</p>
<p>Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.</p>
<p><strong>What is the Microsoft Malware Protection Engine?</strong>
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software.</p>
<p><strong>Does this update contain any additional security-related changes to functionality?</strong>
Yes. In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.</p>
<p><strong>Where can I find more information about Microsoft antimalware technology?</strong>
For more information, visit the <a href="https://www.microsoft.com/security/portal/">Microsoft Malware Protection Center</a>Â website.</p>
<p><strong>Suggested Actions</strong>
<strong>Verify that the update is installed</strong>
Customers should verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded and installed for their Microsoft antimalware products.</p>
<p>For more information on how to verify the version number for the Microsoft Malware Protection Engine that your software is currently using, see the section, "Verifying Update Installation", in <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
<p>For affected software, verify that the Microsoft Malware Protection Engine version is 1.1.13704.0 or later.</p>
<p><strong>If necessary, install the update</strong>
Administrators of enterprise antimalware deployments should ensure that their update management software is configured to automatically approve and distribute engine updates and new malware definitions. Enterprise administrators should also verify that the latest version of the Microsoft Malware Protection Engine and definition updates are being actively downloaded, approved and deployed in their environment.</p>
<p>For end-users, the affected software provides built-in mechanisms for the automatic detection and deployment of this update. For these customers, the update will be applied within 48 hours of its availability. The exact time frame depends on the software used, Internet connection, and infrastructure configuration.</p>
<p>End users that do not wish to wait can manually update their antimalware software.</p>
<p>For more information on how to manually update the Microsoft Malware Protection Engine and malware definitions, refer to <a href="https://support.microsoft.com/kb/2510781">Microsoft Knowledge Base Article 2510781</a>.</p>
Microsoft Malware Protection Engine
CVE-2017-8539
11431
10330
10013
10334
11430
11432
10804
10431
251-10951
251-10952
251-10729
251-10735
251-10789
251-10788
251-10852
251-10853
251-10816
251-10855
251-10047
251-10048
251-10481
251-10482
251-10484
251-10050
251-10051
251-10049
Denial of Service
11431
Denial of Service
10330
Denial of Service
10013
Denial of Service
10334
Denial of Service
11430
Denial of Service
11432
Denial of Service
10804
Denial of Service
10431
Denial of Service
251-10951
Denial of Service
251-10952
Denial of Service
251-10729
Denial of Service
251-10735
Denial of Service
251-10789
Denial of Service
251-10788
Denial of Service
251-10852
Denial of Service
251-10853
Denial of Service
251-10816
Denial of Service
251-10855
Denial of Service
251-10047
Denial of Service
251-10048
Denial of Service
251-10481
Denial of Service
251-10482
Denial of Service
251-10484
Denial of Service
251-10050
Denial of Service
251-10051
Denial of Service
251-10049
Important
11431
Important
10330
Important
10013
Important
10334
Important
11430
Important
11432
Important
10804
Important
10431
Important
251-10951
Important
251-10952
Important
251-10729
Important
251-10735
Important
251-10789
Important
251-10788
Important
251-10852
Important
251-10853
Important
251-10816
Important
251-10855
Important
251-10047
Important
251-10048
Important
251-10481
Important
251-10482
Important
251-10484
Important
251-10050
Important
251-10051
Important
251-10049
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
<p>The following <a href="https://technet.microsoft.com/library/security/dn848375.aspx">mitigating factors</a> may be helpful in your situation:
Systems running supported versions of Windows Server 2008 R2 are not affected if the Desktop Experience feature is not installed.</p>
Mateusz Jurczyk of <a href ="http://www.google.com/">Google Project Zero</a>
1.0
2017-05-25T07:00:00Z
<p>Information published.</p>
Internet Explorer Security Feature Bypass Vulnerability
<p>A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mixed Content warnings. This could allow for the loading of unsecure content (HTTP) from secure locations (HTTPS).</p>
<p>In a web-based attack scenario, an attacker could host a malicious website that is designed to exploit the security feature bypass. Alternatively, in an email or instant message attack scenario, the attacker could send the targeted user a specially crafted .url file that is designed to exploit the bypass. Additionally, compromised websites or websites that accept or host user-provided content could contain specially crafted content to exploit the security feature bypass. However, in all cases an attacker would have no way to force a user to view attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could entice a user to either click a link that directs the user to the attacker's site or send a malicious attachment.</p>
<p>The security update addresses the security feature bypass by correcting how Internet Explorer handles mixed content.</p>
Internet Explorer
CVE-2017-0064
10486-10816
10486-10951
10486-10952
10555-10378
10486-10481
10486-10482
10486-10483
10486-10484
10486-10047
10486-10048
10486-10051
10486-10729
10486-10735
10486-10789
10486-10788
10486-10852
10486-10853
10336-9312
10336-9318
Security Feature Bypass
10486-10816
Security Feature Bypass
10486-10951
Security Feature Bypass
10486-10952
Security Feature Bypass
10555-10378
Security Feature Bypass
10486-10481
Security Feature Bypass
10486-10482
Security Feature Bypass
10486-10483
Security Feature Bypass
10486-10484
Security Feature Bypass
10486-10047
Security Feature Bypass
10486-10048
Security Feature Bypass
10486-10051
Security Feature Bypass
10486-10729
Security Feature Bypass
10486-10735
Security Feature Bypass
10486-10789
Security Feature Bypass
10486-10788
Security Feature Bypass
10486-10852
Security Feature Bypass
10486-10853
Security Feature Bypass
10336-9312
Security Feature Bypass
10336-9318
Low
10486-10816
Important
10486-10951
Important
10486-10952
Low
10555-10378
Important
10486-10481
Important
10486-10482
Low
10486-10483
Important
10486-10484
Important
10486-10047
Important
10486-10048
Low
10486-10051
Important
10486-10729
Important
10486-10735
Important
10486-10789
Important
10486-10788
Important
10486-10852
Important
10486-10853
Low
10336-9312
Low
10336-9318
Publicly Disclosed:Yes;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
2.4
2.2
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10816
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10951
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10952
2.4
2.2
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10555-10378
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10481
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10482
2.4
2.2
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10483
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10484
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10047
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10048
2.4
2.2
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10051
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10729
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10735
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10789
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10788
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10852
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10486-10853
2.4
2.2
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10336-9312
2.4
2.2
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10336-9318
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10816
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10486-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10486-10952
Yes
Security Update
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10555-10378
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10555-10378
Yes
IE Cumulative
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10481
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10481
Yes
IE Cumulative
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10482
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10482
Yes
IE Cumulative
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10483
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10483
Yes
IE Cumulative
4019215
4015550
10486-10484
Yes
Monthly Rollup
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10486-10047
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10047
Yes
IE Cumulative
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10486-10048
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10048
Yes
IE Cumulative
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10486-10051
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10051
Yes
IE Cumulative
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10486-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10486-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10486-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10486-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10853
Yes
Security Update
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10336-9312
Yes
IE Cumulative
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10336-9318
Yes
IE Cumulative
Jun Kokatsu (<a href = "https://twitter.com/shhnjk">@shhnjk</a>)
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows DNS Server Denial of Service Vulnerability
<p>A denial of service vulnerability exists in Windows DNS Server if the server is configured to answer version queries. An attacker who successfully exploited this vulnerability could cause the DNS Server service to become nonresponsive.</p>
<p>An attacker could exploit this vulnerability by sending malicious DNS queries, resulting in denial of service.</p>
<p>The update addresses the vulnerability by correcting how Windows DNS Server processes DNS queries.</p>
Microsoft Windows DNS
CVE-2017-0171
9312
10287
9318
9344
10051
10049
10378
10379
10483
10543
10855
10816
Denial of Service
9312
Denial of Service
10287
Denial of Service
9318
Denial of Service
9344
Denial of Service
10051
Denial of Service
10049
Denial of Service
10378
Denial of Service
10379
Denial of Service
10483
Denial of Service
10543
Denial of Service
10855
Denial of Service
10816
Important
9312
Important
10287
Important
9318
Important
9344
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10855
Important
10816
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation Unlikely;DOS:Permanent
5.3
4.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
9312
5.3
4.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
10287
5.3
4.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
9318
5.3
4.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
9344
5.3
4.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
10051
5.3
4.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
10049
5.3
4.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
10378
5.3
4.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
10379
5.3
4.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
10483
5.3
4.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
10543
5.3
4.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
10855
5.3
4.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
10816
4018196
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018196
3100465
9312
Yes
Security Update
4018196
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018196
3100465
10287
Yes
Security Update
4018196
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018196
3100465
9318
Yes
Security Update
4018196
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018196
3100465
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
Bill Cullen
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows Kernel Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p>
<p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.</p>
<p>The security update addresses the vulnerability by correcting how the Windows kernel initializes memory.</p>
Windows Kernel
CVE-2017-0175
10047
10048
9312
10287
9311
9318
9344
10050
10051
10049
Information Disclosure
10047
Information Disclosure
10048
Information Disclosure
9312
Information Disclosure
10287
Information Disclosure
9311
Information Disclosure
9318
Information Disclosure
9344
Information Disclosure
10050
Information Disclosure
10051
Information Disclosure
10049
Important
10047
Important
10048
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A;Older Software Release:Exploitation More Likely
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10047
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10048
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
9312
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10287
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
9311
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
9318
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
9344
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10050
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10051
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10049
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4018885
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018885
2957189
9312
Yes
Security Update
4018885
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018885
2957189
10287
Yes
Security Update
4018885
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018885
2957189
9311
Yes
Security Update
4018885
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018885
2957189
9318
Yes
Security Update
4018885
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018885
2957189
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
Mateusz Jurczyk of <a href="http://www.google.com">Google Project Zero</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows Hyper-V vSMB Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists when Windows Hyper-V on a host server fails to properly validate vSMB packet data. An attacker who successfully exploited these vulnerabilities could gain elevated privileges on a target operating system.</p>
<p>This vulnerability by itself does not allow arbitrary code to be run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (e.g. a remote code execution vulnerability and another elevation of privilege) that could take advantage of the elevated privileges when running.</p>
<p>The update addresses the vulnerabilities by correcting how Windows Hyper-V validates vSMB packet data.</p>
Windows SMB Server
CVE-2017-0212
10735
10788
10853
10952
10816
10855
Elevation of Privilege
10735
Elevation of Privilege
10788
Elevation of Privilege
10853
Elevation of Privilege
10952
Elevation of Privilege
10816
Elevation of Privilege
10855
Important
10735
Important
10788
Important
10853
Important
10952
Important
10816
Important
10855
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
7.6
6.8
CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
10735
7.6
6.8
CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
10788
7.6
6.8
CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
10853
7.6
6.8
CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
10952
7.6
6.8
CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
10816
7.6
6.8
CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
10855
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
<a href="https://github.com/johnstep">John Stephens</a> - Docker, Inc.
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows COM Elevation of Privilege Vulnerability
<p>An elevation of privilege exists in Windows COM Aggregate Marshaler. An attacker who successfully exploited the vulnerability could run arbitrary code with elevated privileges.</p>
<p>To exploit the vulnerability, an attacker could run a specially crafted application that could exploit the vulnerability. This vulnerability by itself does not allow arbitrary code to be run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (e.g. a remote code execution vulnerability and another elevation of privilege) that could take advantage of the elevated privileges when running.</p>
<p>The update addresses the vulnerability by correcting how Windows COM Marshaler processes interface requests.</p>
Windows COM
CVE-2017-0213
10729
10735
10789
10788
10852
10853
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
10951
10952
Elevation of Privilege
10729
Elevation of Privilege
10735
Elevation of Privilege
10789
Elevation of Privilege
10788
Elevation of Privilege
10852
Elevation of Privilege
10853
Elevation of Privilege
10047
Elevation of Privilege
10048
Elevation of Privilege
10481
Elevation of Privilege
10482
Elevation of Privilege
10484
Elevation of Privilege
9312
Elevation of Privilege
10287
Elevation of Privilege
9311
Elevation of Privilege
9318
Elevation of Privilege
9344
Elevation of Privilege
10050
Elevation of Privilege
10051
Elevation of Privilege
10049
Elevation of Privilege
10378
Elevation of Privilege
10379
Elevation of Privilege
10483
Elevation of Privilege
10543
Elevation of Privilege
10816
Elevation of Privilege
10855
Elevation of Privilege
10951
Elevation of Privilege
10952
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10816
Important
10855
Important
10951
Important
10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely;DOS:N/A
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10729
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10735
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10789
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10788
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10852
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10853
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10047
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10048
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10481
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10482
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10484
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9312
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10287
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9311
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9318
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9344
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10050
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10051
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10049
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10378
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10379
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10483
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10543
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10816
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10855
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10951
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9312
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
10287
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9311
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9318
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
4038788
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788
4034674
10951
Yes
Security Update
4038788
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788
4034674
10952
Yes
Security Update
James Forshaw of <a href="http://www.google.com">Google Project Zero</a>
3.0
2017-09-12T07:00:00Z
<p>To comprehensively address CVE-2017-0213, Microsoft has released security update 4038788 for Windows 10 Version 1703 for 32-bit Systems and Windows 10 Version 1703 for x64-based Systems. Consumers using Windows 10 are automatically protected. Microsoft recommends that enterprise customers running Windows 10 Version 1703 ensure that they have update 4038788 installed to be protected from this vulnerability.</p>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows COM Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists when Windows fails to properly validate input before loading type libraries. An attacker could use this vulnerability to elevate their privilege level.</p>
<p>To exploit this vulnerability an attacker would first need to have access to the local system and have the ability to execute a malicious application.</p>
<p>The update corrects how Windows validates permissions when loading type libraries.</p>
Windows COM
CVE-2017-0214
10729
10735
10789
10788
10852
10853
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
10951
10952
Elevation of Privilege
10729
Elevation of Privilege
10735
Elevation of Privilege
10789
Elevation of Privilege
10788
Elevation of Privilege
10852
Elevation of Privilege
10853
Elevation of Privilege
10047
Elevation of Privilege
10048
Elevation of Privilege
10481
Elevation of Privilege
10482
Elevation of Privilege
10484
Elevation of Privilege
9312
Elevation of Privilege
10287
Elevation of Privilege
9311
Elevation of Privilege
9318
Elevation of Privilege
9344
Elevation of Privilege
10050
Elevation of Privilege
10051
Elevation of Privilege
10049
Elevation of Privilege
10378
Elevation of Privilege
10379
Elevation of Privilege
10483
Elevation of Privilege
10543
Elevation of Privilege
10816
Elevation of Privilege
10855
Elevation of Privilege
10951
Elevation of Privilege
10952
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10816
Important
10855
Important
10951
Important
10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10729
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10735
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10789
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10788
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10852
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10853
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10047
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10048
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10481
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10482
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10484
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9312
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10287
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9311
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9318
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9344
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10050
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10051
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10049
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10378
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10379
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10483
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10543
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10816
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10855
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10951
6.7
6.0
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9312
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
10287
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9311
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9318
Yes
Security Update
4018556
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018556
4011981
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
James Forshaw of <a href="http://www.google.com">Google Project Zero</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows Kernel Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p>
<p>An authenticated attacker could exploit this vulnerability by running a specially crafted application.</p>
<p>The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.</p>
Windows Kernel
CVE-2017-0220
10047
10048
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
Information Disclosure
10047
Information Disclosure
10048
Information Disclosure
9312
Information Disclosure
10287
Information Disclosure
9311
Information Disclosure
9318
Information Disclosure
9344
Information Disclosure
10050
Information Disclosure
10051
Information Disclosure
10049
Information Disclosure
10378
Information Disclosure
10379
Important
10047
Important
10048
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A;Older Software Release:Exploitation More Likely
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10047
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10048
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
9312
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10287
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
9311
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
9318
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
9344
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10050
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10051
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10049
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10378
4.7
4.2
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
10379
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4018821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018821
3092601
9312
Yes
Security Update
4018821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018821
3092601
10287
Yes
Security Update
4018821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018821
3092601
9311
Yes
Security Update
4018821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018821
3092601
9318
Yes
Security Update
4018821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018821
3092601
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
Mateusz Jurczyk of <a href="http://www.google.com">Google Project Zero</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Microsoft Edge Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by way of enticement in an email or Instant Messenger message, or by getting them to open an attachment sent through email.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft Edge handles objects in memory.</p>
Microsoft Edge
CVE-2017-0221
10724-10852
10724-10853
Remote Code Execution
10724-10852
Remote Code Execution
10724-10853
Critical
10724-10852
Critical
10724-10853
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O
10724-10852
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O
10724-10853
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10853
Yes
Security Update
Liu Long of <a href="http://www.360.com/">Qihoo 360 Vulcan Team</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Internet Explorer Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>An attacker could host a specially crafted website designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action, typically by an enticement in an email or instant message, or by getting the user to open an attachment sent through email.</p>
<p>The security update addresses the vulnerability by modifying how Internet Explorer handles objects in memory.</p>
Internet Explorer
CVE-2017-0222
10486-10816
10555-10378
10486-10481
10486-10482
10486-10483
10486-10484
10486-10047
10486-10048
10486-10051
10486-10729
10486-10735
10486-10789
10486-10788
10486-10852
10486-10853
10336-9312
10336-9318
10486-10951
10486-10952
Remote Code Execution
10486-10816
Remote Code Execution
10555-10378
Remote Code Execution
10486-10481
Remote Code Execution
10486-10482
Remote Code Execution
10486-10483
Remote Code Execution
10486-10484
Remote Code Execution
10486-10047
Remote Code Execution
10486-10048
Remote Code Execution
10486-10051
Remote Code Execution
10486-10729
Remote Code Execution
10486-10735
Remote Code Execution
10486-10789
Remote Code Execution
10486-10788
Remote Code Execution
10486-10852
Remote Code Execution
10486-10853
Remote Code Execution
10336-9312
Remote Code Execution
10336-9318
Remote Code Execution
10486-10951
Remote Code Execution
10486-10952
Moderate
10486-10816
Moderate
10555-10378
Critical
10486-10481
Critical
10486-10482
Moderate
10486-10483
Critical
10486-10484
Critical
10486-10047
Critical
10486-10048
Moderate
10486-10051
Critical
10486-10729
Critical
10486-10735
Critical
10486-10789
Critical
10486-10788
Moderate
10486-10852
Moderate
10486-10853
Critical
10336-9312
Critical
10336-9318
Moderate
10486-10951
Moderate
10486-10952
Publicly Disclosed:No;Exploited:Yes;Latest Software Release:Exploitation Detected;Older Software Release:Exploitation Detected
6.0
5.4
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10816
6.0
5.4
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10555-10378
7.1
6.4
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10481
7.1
6.4
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10482
6.0
5.4
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10483
7.1
6.4
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10484
7.1
6.4
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10047
7.1
6.4
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10048
6.0
5.4
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10051
7.1
6.4
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10729
7.1
6.4
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10735
7.1
6.4
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10789
7.1
6.4
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10788
6.0
5.4
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10852
6.0
5.4
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10853
6.0
5.4
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10336-9312
6.0
5.4
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10336-9318
6.0
5.4
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10951
6.0
5.4
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L/E:P/RL:O/RC:C
10486-10952
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10816
Yes
Security Update
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10555-10378
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10555-10378
Yes
IE Cumulative
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10481
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10481
Yes
IE Cumulative
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10482
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10482
Yes
IE Cumulative
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10483
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10483
Yes
IE Cumulative
4019215
4015550
10486-10484
Yes
Monthly Rollup
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10486-10047
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10047
Yes
IE Cumulative
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10486-10048
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10048
Yes
IE Cumulative
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10486-10051
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10051
Yes
IE Cumulative
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10486-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10486-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10486-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10486-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10853
Yes
Security Update
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10336-9312
Yes
IE Cumulative
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10336-9318
Yes
IE Cumulative
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10486-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10486-10952
Yes
Security Update
2.1
2017-06-13T07:00:00Z
<p>Revised Affected Products table to include Internet Explorer 9 on Windows Server 2008 for 32-bit Systems Service Pack 2, and Internet Explorer 9 on Windows Server 2008 for x64-based Systems Service Pack 2.</p>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Internet Explorer Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>An attacker could host a specially crafted website designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action, typically by an enticement in an email or instant message, or by getting the user to open an attachment sent through email.</p>
<p>The security update addresses the vulnerability by modifying how Internet Explorer handles objects in memory.</p>
Internet Explorer
CVE-2017-0226
10486-10951
10486-10952
10486-10816
10555-10378
10486-10481
10486-10482
10486-10483
10486-10484
10486-10729
10486-10735
10486-10789
10486-10788
10486-10852
10486-10853
Remote Code Execution
10486-10951
Remote Code Execution
10486-10952
Remote Code Execution
10486-10816
Remote Code Execution
10555-10378
Remote Code Execution
10486-10481
Remote Code Execution
10486-10482
Remote Code Execution
10486-10483
Remote Code Execution
10486-10484
Remote Code Execution
10486-10729
Remote Code Execution
10486-10735
Remote Code Execution
10486-10789
Remote Code Execution
10486-10788
Remote Code Execution
10486-10852
Remote Code Execution
10486-10853
Important
10486-10951
Important
10486-10952
Low
10486-10816
Low
10555-10378
Important
10486-10481
Important
10486-10482
Low
10486-10483
Important
10486-10484
Important
10486-10729
Important
10486-10735
Important
10486-10789
Important
10486-10788
Important
10486-10852
Important
10486-10853
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10951
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10952
6.4
5.8
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10816
6.4
5.8
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10555-10378
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10481
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10482
6.4
5.8
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10483
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10484
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10729
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10735
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10789
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10788
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10852
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10853
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10486-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10486-10952
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10816
Yes
Security Update
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10555-10378
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10555-10378
Yes
IE Cumulative
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10481
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10481
Yes
IE Cumulative
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10482
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10482
Yes
IE Cumulative
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10483
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10483
Yes
IE Cumulative
4019215
4015550
10486-10484
Yes
Monthly Rollup
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10486-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10486-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10486-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10486-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10853
Yes
Security Update
SandboxEscaper working with <a href="https://www.zerodayinitiative.com/">Trend Micro’s Zero Day Initiative (ZDI)</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Scripting Engine Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p>
<p>In a web-based attack scenario, an attacker could host a website in an attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could trick a user into clicking a link that takes the user to the attacker's site.</p>
<p>The security update addresses the vulnerability by changing how the scripting engine handles objects in memory.</p>
Microsoft Edge
CVE-2017-0227
10724-10729
10724-10735
10724-10789
10724-10788
10724-10852
10724-10853
10724-10951
10724-10952
Remote Code Execution
10724-10729
Remote Code Execution
10724-10735
Remote Code Execution
10724-10789
Remote Code Execution
10724-10788
Remote Code Execution
10724-10852
Remote Code Execution
10724-10853
Remote Code Execution
10724-10951
Remote Code Execution
10724-10952
Critical
10724-10729
Critical
10724-10735
Critical
10724-10789
Critical
10724-10788
Critical
10724-10852
Critical
10724-10853
Critical
10724-10951
Critical
10724-10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10729
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10735
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10789
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10788
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10852
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10853
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10951
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10952
Yes
Security Update
Liu Long of Qihoo <a href="http://www.360.com/">360 Vulcan Team </a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Scripting Engine Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.</p>
<p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the related rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p>
<p>An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines handle objects in memory.</p>
Microsoft Scripting Engine
CVE-2017-0229
10724-10729
10724-10735
10724-10789
10724-10788
10724-10852
10724-10853
10724-10951
10724-10952
Remote Code Execution
10724-10729
Remote Code Execution
10724-10735
Remote Code Execution
10724-10789
Remote Code Execution
10724-10788
Remote Code Execution
10724-10852
Remote Code Execution
10724-10853
Remote Code Execution
10724-10951
Remote Code Execution
10724-10952
Critical
10724-10729
Critical
10724-10735
Critical
10724-10789
Critical
10724-10788
Critical
10724-10852
Critical
10724-10853
Critical
10724-10951
Critical
10724-10952
Publicly Disclosed:Yes;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation Unlikely
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10729
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10735
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10789
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10788
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10852
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10853
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10951
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10952
Yes
Security Update
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Scripting Engine Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.</p>
<p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the related rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p>
<p>An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines handle objects in memory.</p>
Microsoft Edge
CVE-2017-0228
10486-10481
10486-10482
10486-10483
10486-10484
10486-10729
10486-10735
10486-10789
10486-10788
10486-10852
10486-10853
10486-10816
10486-10951
10486-10952
10724-10951
10724-10952
10724-10729
10724-10735
10724-10789
10724-10788
10724-10852
10724-10853
Remote Code Execution
10486-10481
Remote Code Execution
10486-10482
Remote Code Execution
10486-10483
Remote Code Execution
10486-10484
Remote Code Execution
10486-10729
Remote Code Execution
10486-10735
Remote Code Execution
10486-10789
Remote Code Execution
10486-10788
Remote Code Execution
10486-10852
Remote Code Execution
10486-10853
Remote Code Execution
10486-10816
Remote Code Execution
10486-10951
Remote Code Execution
10486-10952
Remote Code Execution
10724-10951
Remote Code Execution
10724-10952
Remote Code Execution
10724-10729
Remote Code Execution
10724-10735
Remote Code Execution
10724-10789
Remote Code Execution
10724-10788
Remote Code Execution
10724-10852
Remote Code Execution
10724-10853
Critical
10486-10481
Critical
10486-10482
Moderate
10486-10483
Critical
10486-10484
Critical
10486-10729
Critical
10486-10735
Critical
10486-10789
Critical
10486-10788
Critical
10486-10852
Critical
10486-10853
Moderate
10486-10816
Critical
10486-10951
Critical
10486-10952
Critical
10724-10951
Critical
10724-10952
Critical
10724-10729
Critical
10724-10735
Critical
10724-10789
Critical
10724-10788
Critical
10724-10852
Critical
10724-10853
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10481
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10482
6.4
5.8
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10483
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10484
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10729
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10735
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10789
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10788
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10852
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10853
6.4
5.8
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10816
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10951
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10952
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10951
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10952
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10729
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10735
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10789
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10788
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10852
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10853
4034681
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034681
4025336
10486-10481
Yes
Monthly Rollup
4034733
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034733
4025252
10486-10481
Yes
IE Cumulative
4034681
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034681
4025336
10486-10482
Yes
Monthly Rollup
4034733
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034733
4025252
10486-10482
Yes
IE Cumulative
4034681
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034681
4025336
10486-10483
Yes
Monthly Rollup
4034733
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034733
4025252
10486-10483
Yes
IE Cumulative
4034681
4025336
10486-10484
Yes
Monthly Rollup
4034668
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034668
4025338
10486-10729
Yes
Security Update
4034668
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034668
4025338
10486-10735
Yes
Security Update
4034660
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034660
4025344
10486-10789
Yes
Security Update
4034660
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034660
4025344
10486-10788
Yes
Security Update
4034658
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034658
4025339
10486-10852
Yes
Security Update
4034658
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034658
4025339
10486-10853
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10816
Yes
Security Update
4034674
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034674
4025342
10486-10951
Yes
Security Update
4034674
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034674
4025342
10486-10952
Yes
Security Update
4034674
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034674
4025342
10724-10951
Yes
Security Update
4034674
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034674
4025342
10724-10952
Yes
Security Update
4034668
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034668
4025338
10724-10729
Yes
Security Update
4034668
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034668
4025338
10724-10735
Yes
Security Update
4034660
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034660
4025344
10724-10789
Yes
Security Update
4034660
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034660
4025344
10724-10788
Yes
Security Update
4034658
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034658
4025339
10724-10852
Yes
Security Update
4034658
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034658
4025339
10724-10853
Yes
Security Update
Tencent Security - Team Sniper (Keen Lab and PC Mgr) and 01 working with <a href="http://www.zerodayinitiative.com/">Trend Micro’s Zero Day Initiative (ZDI)</a>
Yuki Chen of Qihoo 360 Vulcan team
1.1
2017-06-20T07:00:00Z
<p>Revised Affected Products table to include Microsoft Edge on Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, and Windows 10 Version 1703 because these products are affected by this CVE. This is an informational change only.</p>
2.0
2017-08-08T07:00:00Z
<p>To comprehensively address CVE-2017-0228, Microsoft has released August security updates for Internet Explorer 11 on affected editions of Windows 8.1, Windows Server 2012 R2, Windows 8.1 RT, Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, and Windows 10 Version 1703; and for Microsoft Edge on affected editions of Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, and Windows 10 Version 1703. Microsoft strongly recommends that customers install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.</p>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.1
2017-08-09T07:00:00Z
<p>Removed Windows Server 2012 from affected software table.</p>
2.2
2018-03-14T07:00:00Z
<p>Acknowledgement added.</p>
Scripting Engine Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.</p>
<p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the related rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p>
<p>An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines handle objects in memory.</p>
Microsoft Scripting Engine
CVE-2017-0230
10724-10852
10724-10853
10724-10951
10724-10952
Remote Code Execution
10724-10852
Remote Code Execution
10724-10853
Remote Code Execution
10724-10951
Remote Code Execution
10724-10952
Important
10724-10852
Important
10724-10853
Important
10724-10951
Important
10724-10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10852
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10853
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10951
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10952
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10952
Yes
Security Update
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Microsoft Browser Spoofing Vulnerability
<p>A spoofing vulnerability exists when Microsoft browsers render SmartScreen Filter. An attacker who successfully exploited this vulnerability could trick a user by redirecting the user to a specially crafted website. The specially crafted website could then either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services.</p>
<p>To exploit the vulnerability, the user must click a specially crafted URL. In an email attack scenario, an attacker could send an email message containing the specially crafted URL to the user in an attempt to convince the user to click it.</p>
<p>In a web-based attack scenario, an attacker could host a specially crafted website designed to appear as a legitimate website to the user. However, the attacker would have no way to force the user to visit the specially crafted website. The attacker would have to convince the user to visit the specially crafted website, typically by way of enticement in an email or Instant Messenger message, and then convince the user to interact with content on the website. The update addresses the vulnerability by correcting how Microsoft browsers parse HTML.</p>
Microsoft Edge
CVE-2017-0231
10486-10481
10486-10482
10486-10483
10486-10484
10486-10047
10486-10048
10486-10729
10486-10735
10486-10789
10486-10788
10486-10852
10486-10853
10724-10729
10724-10735
10724-10789
10724-10788
10724-10852
10724-10853
10724-10951
10724-10952
10486-10951
10486-10952
10486-10816
Spoofing
10486-10481
Spoofing
10486-10482
Spoofing
10486-10483
Spoofing
10486-10484
Spoofing
10486-10047
Spoofing
10486-10048
Spoofing
10486-10729
Spoofing
10486-10735
Spoofing
10486-10789
Spoofing
10486-10788
Spoofing
10486-10852
Spoofing
10486-10853
Spoofing
10724-10729
Spoofing
10724-10735
Spoofing
10724-10789
Spoofing
10724-10788
Spoofing
10724-10852
Spoofing
10724-10853
Spoofing
10724-10951
Spoofing
10724-10952
Spoofing
10486-10951
Spoofing
10486-10952
Spoofing
10486-10816
Important
10486-10481
Important
10486-10482
Low
10486-10483
Important
10486-10484
Important
10486-10047
Important
10486-10048
Important
10486-10729
Important
10486-10735
Important
10486-10789
Important
10486-10788
Important
10486-10852
Important
10486-10853
Important
10724-10729
Important
10724-10735
Important
10724-10789
Important
10724-10788
Important
10724-10852
Important
10724-10853
Important
10724-10951
Important
10724-10952
Important
10486-10951
Important
10486-10952
Low
10486-10816
Publicly Disclosed:Yes;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10481
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10482
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10483
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10484
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10047
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10048
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10729
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10735
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10789
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10788
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10852
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10853
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10729
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10735
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10789
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10788
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10852
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10853
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10951
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10952
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10951
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10952
4.3
3.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
10486-10816
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10481
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10481
Yes
IE Cumulative
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10482
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10482
Yes
IE Cumulative
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10483
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10483
Yes
IE Cumulative
4019215
4015550
10486-10484
Yes
Monthly Rollup
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10486-10047
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10047
Yes
IE Cumulative
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10486-10048
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10048
Yes
IE Cumulative
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10486-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10486-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10486-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10486-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10853
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10952
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10486-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10486-10952
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10816
Yes
Security Update
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Microsoft Edge Elevation of Privilege Vulnerability
<p>An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser. An attacker who successfully exploited this vulnerability could gain elevated privileges and break out of the Edge AppContainer sandbox.</p>
<p>The vulnerability by itself does not allow arbitrary code to run. However, this vulnerability could be used in conjunction with one or more vulnerabilities (for example a remote code execution vulnerability and another elevation of privilege vulnerability) to take advantage of the elevated privileges when running.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft Edge handles sandboxing.</p>
Microsoft Edge
CVE-2017-0233
10724-10729
10724-10735
10724-10789
10724-10788
10724-10852
10724-10853
10724-10951
10724-10952
Elevation of Privilege
10724-10729
Elevation of Privilege
10724-10735
Elevation of Privilege
10724-10789
Elevation of Privilege
10724-10788
Elevation of Privilege
10724-10852
Elevation of Privilege
10724-10853
Elevation of Privilege
10724-10951
Elevation of Privilege
10724-10952
Important
10724-10729
Important
10724-10735
Important
10724-10789
Important
10724-10788
Important
10724-10852
Important
10724-10853
Important
10724-10951
Important
10724-10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10729
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10735
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10789
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10788
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10852
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10853
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10951
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10952
Yes
Security Update
Tencent Security – Team Ether working with <a href="http://www.zerodayinitiative.com/">Trend Micro’s Zero Day Initiative (ZDI)</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Scripting Engine Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.</p>
<p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the related rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p>
<p>An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines handle objects in memory.</p>
Microsoft Scripting Engine
CVE-2017-0234
10724-10729
10724-10735
10724-10789
10724-10788
10724-10852
10724-10853
10724-10951
10724-10952
Remote Code Execution
10724-10729
Remote Code Execution
10724-10735
Remote Code Execution
10724-10789
Remote Code Execution
10724-10788
Remote Code Execution
10724-10852
Remote Code Execution
10724-10853
Remote Code Execution
10724-10951
Remote Code Execution
10724-10952
Important
10724-10729
Important
10724-10735
Important
10724-10789
Important
10724-10788
Important
10724-10852
Important
10724-10853
Important
10724-10951
Important
10724-10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10729
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10735
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10789
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10788
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10852
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10853
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10951
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10952
Yes
Security Update
Tencent Security – Team Ether working with <a href="http://www.zerodayinitiative.com/">Trend Micro’s Zero Day Initiative (ZDI)</a>
Yuange of <a href="http://slab.qq.com/zhanlu.html">Tencent Zhanlu Lab</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Scripting Engine Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.</p>
<p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the related rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p>
<p>An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines handle objects in memory.</p>
Microsoft Scripting Engine
CVE-2017-0235
10724-10951
10724-10952
Remote Code Execution
10724-10951
Remote Code Execution
10724-10952
Critical
10724-10951
Critical
10724-10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10951
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10952
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10952
Yes
Security Update
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Scripting Engine Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.</p>
<p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the related rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p>
<p>An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines handle objects in memory.</p>
Microsoft Scripting Engine
CVE-2017-0236
10724-10729
10724-10735
10724-10789
10724-10788
10724-10852
10724-10853
10724-10951
10724-10952
Remote Code Execution
10724-10729
Remote Code Execution
10724-10735
Remote Code Execution
10724-10789
Remote Code Execution
10724-10788
Remote Code Execution
10724-10852
Remote Code Execution
10724-10853
Remote Code Execution
10724-10951
Remote Code Execution
10724-10952
Critical
10724-10729
Critical
10724-10735
Critical
10724-10789
Critical
10724-10788
Critical
10724-10852
Critical
10724-10853
Critical
10724-10951
Critical
10724-10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10729
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10735
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10789
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10788
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10852
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10853
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10951
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10952
Yes
Security Update
Tencent Security - Lance Team working with <a href="http://www.zerodayinitiative.com/">Trend Micro's Zero Day Initiative</a>
Yuki Chen of <a href="http://www.360.cn/">Qihoo 360 Vulcan Team</a> working with <a href="http://www.zerodayinitiative.com/">Trend Micro’s Zero Day Initiative (ZDI)</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Microsoft Edge Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by way of enticement in an email or Instant Messenger message, or by getting them to open an attachment sent through email.</p>
<p>The security update addresses the vulnerability by modifying how Microsoft Edge handles objects in memory.</p>
Microsoft Scripting Engine
CVE-2017-0238
10724-10729
10724-10735
10724-10789
10724-10788
10724-10852
10724-10853
10555-10378
10486-10481
10486-10482
10486-10483
10486-10484
10486-10729
10486-10735
10486-10789
10486-10788
10486-10852
10486-10853
10336-9312
10336-9318
10724-10951
10724-10952
Remote Code Execution
10724-10729
Remote Code Execution
10724-10735
Remote Code Execution
10724-10789
Remote Code Execution
10724-10788
Remote Code Execution
10724-10852
Remote Code Execution
10724-10853
Remote Code Execution
10555-10378
Remote Code Execution
10486-10481
Remote Code Execution
10486-10482
Remote Code Execution
10486-10483
Remote Code Execution
10486-10484
Remote Code Execution
10486-10729
Remote Code Execution
10486-10735
Remote Code Execution
10486-10789
Remote Code Execution
10486-10788
Remote Code Execution
10486-10852
Remote Code Execution
10486-10853
Remote Code Execution
10336-9312
Remote Code Execution
10336-9318
Remote Code Execution
10724-10951
Remote Code Execution
10724-10952
Important
10724-10729
Important
10724-10735
Important
10724-10789
Important
10724-10788
Important
10724-10852
Important
10724-10853
Low
10555-10378
Important
10486-10481
Important
10486-10482
Low
10486-10483
Important
10486-10484
Important
10486-10729
Important
10486-10735
Important
10486-10789
Important
10486-10788
Important
10486-10852
Important
10486-10853
Low
10336-9312
Low
10336-9318
Important
10724-10951
Important
10724-10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10729
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10735
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10789
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10788
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10852
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10853
6.4
5.8
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10555-10378
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10481
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10482
6.4
5.8
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10483
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10484
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10729
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10735
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10789
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10788
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10852
7.5
6.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10486-10853
6.4
5.8
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10336-9312
6.4
5.8
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10336-9318
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10951
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10853
Yes
Security Update
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10555-10378
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10555-10378
Yes
IE Cumulative
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10481
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10481
Yes
IE Cumulative
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10482
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10482
Yes
IE Cumulative
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10486-10483
Yes
Monthly Rollup
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10486-10483
Yes
IE Cumulative
4019215
4015550
10486-10484
Yes
Monthly Rollup
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10486-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10486-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10486-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10486-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10486-10853
Yes
Security Update
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10336-9312
Yes
IE Cumulative
4018271
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018271
4014661
10336-9318
Yes
IE Cumulative
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10952
Yes
Security Update
Yuki Chen of <a href="http://www.360.cn/">Qihoo 360 Vulcan Team</a> working with <a href="http://www.zerodayinitiative.com/">Trend Micro’s Zero Day Initiative (ZDI)</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Scripting Engine Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p>
<p>The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.</p>
Microsoft Edge
CVE-2017-0240
10724-10729
10724-10735
10724-10789
10724-10788
10724-10852
10724-10853
10724-10951
10724-10952
Remote Code Execution
10724-10729
Remote Code Execution
10724-10735
Remote Code Execution
10724-10789
Remote Code Execution
10724-10788
Remote Code Execution
10724-10852
Remote Code Execution
10724-10853
Remote Code Execution
10724-10951
Remote Code Execution
10724-10952
Critical
10724-10729
Critical
10724-10735
Critical
10724-10789
Critical
10724-10788
Critical
10724-10852
Critical
10724-10853
Critical
10724-10951
Critical
10724-10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10729
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10735
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10789
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10788
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10852
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10853
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10951
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10952
Yes
Security Update
Richard Zhu (fluorescence) working with <a href="http://www.zerodayinitiative.com/">Trend Micro’s Zero Day Initiative (ZDI)</a>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Microsoft Edge Elevation of Privilege Vulnerability
<p>A vulnerability exists when Microsoft Edge renders a domain-less page in the URL, which could allow Microsoft Edge to perform actions in the context of the Intranet Zone and access functionality that is not typically available to the browser when browsing in the context of the Internet Zone.</p>
<p>To exploit the vulnerability, an attacker would have to convince a user to browse to a maliciously created webpage.</p>
<p>The security update addresses the vulnerability by correcting the use of domain-less pages generated in the URL bar by the browser.</p>
Microsoft Edge
CVE-2017-0241
10724-10729
10724-10735
10724-10789
10724-10788
10724-10852
10724-10853
10724-10951
10724-10952
Elevation of Privilege
10724-10729
Elevation of Privilege
10724-10735
Elevation of Privilege
10724-10789
Elevation of Privilege
10724-10788
Elevation of Privilege
10724-10852
Elevation of Privilege
10724-10853
Elevation of Privilege
10724-10951
Elevation of Privilege
10724-10952
Important
10724-10729
Important
10724-10735
Important
10724-10789
Important
10724-10788
Important
10724-10852
Important
10724-10853
Important
10724-10951
Important
10724-10952
Publicly Disclosed:Yes;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A
3.1
2.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10724-10729
3.1
2.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10724-10735
3.1
2.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10724-10789
3.1
2.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10724-10788
3.1
2.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10724-10852
3.1
2.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10724-10853
3.1
2.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10724-10951
3.1
2.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
10724-10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10724-10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10952
Yes
Security Update
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
May 2017 Adobe Flash Security Update
<p>This security update addresses the following vulnerabilities, which are described in Adobe Security Bulletin <a href="http://helpx.adobe.com/security/products/flash-player/apsb17-15.html">APSB17-15</a>:</p>
<p>CVE-2017-3068,CVE-2017-3069,CVE-2017-3070,CVE-2017-3071,CVE-2017-3072,CVE-2017-3073,CVE-2017-3074</p>
<p><strong>How could an attacker exploit these vulnerabilities?</strong>
In a web-based attack scenario where the user is using Internet Explorer for the desktop, an attacker could host a specially crafted website that is designed to exploit any of these vulnerabilities through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit any of these vulnerabilities. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by clicking a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email.</p>
<p>In a web-based attack scenario where the user is using Internet Explorer in the Windows 8-style UI, an attacker would first need to compromise a website already listed in the Compatibility View (CV) list. An attacker could then host a website that contains specially crafted Flash content designed to exploit any of these vulnerabilities through Internet Explorer and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by clicking a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email. For more information about Internet Explorer and the CV List, please see the MSDN Article, Developer Guidance for websites with content for Adobe Flash Player in Windows 8.</p>
Adobe Flash Player
ADV170006
10384-10481
10384-10482
10384-10484
10384-10483
10384-10735
10384-10729
10384-10789
10384-10788
10384-10852
10384-10853
10384-10816
10384-10951
10384-10952
10384-10378
Remote Code Execution
10384-10481
Remote Code Execution
10384-10482
Remote Code Execution
10384-10484
Remote Code Execution
10384-10483
Remote Code Execution
10384-10735
Remote Code Execution
10384-10729
Remote Code Execution
10384-10789
Remote Code Execution
10384-10788
Remote Code Execution
10384-10852
Remote Code Execution
10384-10853
Remote Code Execution
10384-10816
Remote Code Execution
10384-10951
Remote Code Execution
10384-10952
Remote Code Execution
10384-10378
Critical
10384-10481
Critical
10384-10482
Critical
10384-10484
Critical
10384-10483
Critical
10384-10735
Critical
10384-10729
Critical
10384-10789
Critical
10384-10788
Critical
10384-10852
Critical
10384-10853
Critical
10384-10816
Critical
10384-10951
Critical
10384-10952
Critical
10384-10378
Publicly Disclosed:No;Exploited:No
4020821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4020821
4018483
10384-10481
Yes
Security Update
4020821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4020821
4018483
10384-10482
Yes
Security Update
4020821
4018483
10384-10484
Yes
Security Update
4020821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4020821
4018483
10384-10483
Yes
Security Update
4020821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4020821
4018483
10384-10735
Yes
Security Update
4020821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4020821
4018483
10384-10729
Yes
Security Update
4020821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4020821
4018483
10384-10789
Yes
Security Update
4020821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4020821
4018483
10384-10788
Yes
Security Update
4020821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4020821
4018483
10384-10852
Yes
Security Update
4020821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4020821
4018483
10384-10853
Yes
Security Update
4020821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4020821
4018483
10384-10816
Yes
Security Update
4020821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4020821
4018483
10384-10951
Yes
Security Update
4020821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4020821
4018483
10384-10952
Yes
Security Update
4020821
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4020821
4018483
10384-10378
Yes
Security Update
<p>The following <a href="https://technet.microsoft.com/library/security/dn848375.aspx#Mitigation">mitigating factors</a> may be helpful in your situation:</p>
<ul>
<li>In a web-based attack scenario where the user is using Internet Explorer for the desktop, an attacker could host a website that contains a webpage that is used to exploit any of these vulnerabilities. In addition, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit any of these vulnerabilities. In all cases, however, an attacker would have no way to force users to visit these websites. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or instant message that takes users to the attacker's website.</li>
<li>Internet Explorer in the Windows 8-style UI will only play Flash content from sites listed on the Compatibility View (CV) list. This restriction requires an attacker to first compromise a website already listed on the CV list. An attacker could then host specially crafted Flash content designed to exploit any of these vulnerabilities through Internet Explorer and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by clicking a link in an email message or in an instant message that takes users to the attacker's website, or by opening an attachment sent through email.</li>
<li>By default, all supported versions of Microsoft Outlook and Windows Live Mail open HTML email messages in the Restricted sites zone. The Restricted sites zone, which disables scripts and ActiveX controls, helps reduce the risk of an attacker being able to use any of these vulnerabilities to execute malicious code. If a user clicks a link in an email message, the user could still be vulnerable to exploitation of any of these vulnerabilities through the web-based attack scenario.</li>
<li>By default, Internet Explorer on Windows Server 2012 and Windows Server 2012 R2 runs in a restricted mode that is known as <a href="https://technet.microsoft.com/library/dd883248.aspx">Enhanced Security Configuration</a>. This mode can help reduce the likelihood of the exploitation of these Adobe Flash Player vulnerabilities in Internet Explorer.</li>
</ul>
<p>Workaround refers to a setting or configuration change that would help block known attack vectors before you apply the update.</p>
<p><strong>Prevent Adobe Flash Player from running</strong>
You can disable attempts to instantiate Adobe Flash Player in Internet Explorer and other applications that honor the kill bit feature, such as Office 2007 and Office 2010, by setting the kill bit for the control in the registry.</p>
<p><strong>Warning</strong> If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
To set the kill bit for the control in the registry, perform the following steps:</p>
<ol>
<li><p>Paste the following into a text file and save it with the .reg file extension.</p>
<pre><code> Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"Compatibility Flags"=dword:00000400
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"Compatibility Flags"=dword:00000400
</code></pre>
</li>
<li><p>Double-click the .reg file to apply it to an individual system.</p>
<p>You can also apply this workaround across domains by using Group Policy. For more information about Group Policy, see the TechNet article, Group Policy collection.</p>
</li>
</ol>
<p><strong>Note</strong> You must restart Internet Explorer for your changes to take effect.
<strong>Impact of workaround</strong>. There is no impact as long as the object is not intended to be used in Internet Explorer.
<strong>How to undo the workaround.</strong> Delete the registry keys that were added in implementing this workaround.
<strong>Prevent Adobe Flash Player from running in Internet Explorer through Group Policy</strong>
<strong>Note</strong> The Group Policy MMC snap-in can be used to set policy for a machine, for an organizational unit, or for an entire domain. For more information about Group Policy, visit the following Microsoft Web sites:</p>
<p><a href="https://technet.microsoft.com/library/hh831791">Group Policy Overview</a>
<a href="https://technet.microsoft.com/library/cc737816%28v=ws.10%29.aspx">What is Group Policy Object Editor?</a>
<a href="https://technet.microsoft.com/library/cc784165%28v=ws.10%29.aspx">Core Group Policy tools and settings</a></p>
<p>To disable Adobe Flash Player in Internet Explorer through Group Policy, perform the following steps:
<strong>Note</strong> This workaround does not prevent Flash from being invoked from other applications, such as Microsoft Office 2007 or Microsoft Office 2010.</p>
<ol>
<li>Open the Group Policy Management Console and configure the console to work with the appropriate Group Policy object, such as local machine, OU, or domain GPO.</li>
<li>Navigate to the following node:
<strong>Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Add-on Management</strong></li>
<li>Double-click <strong>Turn off Adobe Flash in Internet Explorer and prevent applications from using Internet Explorer technology to instantiate Flash objects</strong>.</li>
<li>Change the setting to Enabled.</li>
<li>Click <strong>Apply</strong> and then click <strong>OK</strong> to return to the Group Policy Management Console.</li>
<li>Refresh Group Policy on all systems or wait for the next scheduled Group Policy refresh interval for the settings to take effect.
<strong>Prevent Adobe Flash Player from running in Office 2010 on affected systems</strong>
<strong>Note</strong> This workaround does not prevent Adobe Flash Player from running in Internet Explorer.
<strong>Warning</strong> If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
For detailed steps that you can use to prevent a control from running in Internet Explorer, see Microsoft Knowledge Base Article 240797. Follow the steps in the article to create a Compatibility Flags value in the registry to prevent a COM object from being instantiated in Internet Explorer.</li>
</ol>
<p>To disable Adobe Flash Player in Office 2010 only, set the kill bit for the ActiveX control for Adobe Flash Player in the registry using the following steps:</p>
<ol>
<li>Create a text file named Disable_Flash.reg with the following contents:</li>
</ol>
<pre><code> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common\COM\Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}]
"Compatibility Flags"=dword:00000400
</code></pre>
<ol start="2">
<li>Double-click the .reg file to apply it to an individual system.</li>
<li><strong>Note</strong> You must restart Internet Explorer for your changes to take effect.
You can also apply this workaround across domains by using Group Policy. For more information about Group Policy, see the TechNet article, <a href="http://go.microsoft.com/fwlink/?LinkID=215719">Group Policy collection</a>.
<strong>Prevent ActiveX controls from running in Office 2007 and Office 2010</strong></li>
</ol>
<p>To disable all ActiveX controls in Microsoft Office 2007 and Microsoft Office 2010, including Adobe Flash Player in Internet Explorer, perform the following steps:</p>
<ol>
<li>Click File, click Options, click Trust Center, and then click Trust Center Settings.</li>
<li>Click ActiveX Settings in the left-hand pane, and then select Disable all controls without notifications.</li>
<li>Click OK to save your settings.
<strong>Impact of workaround</strong>. Office documents that use embedded ActiveX controls may not display as intended.
<strong>How to undo the workaround</strong>.</li>
</ol>
<p>To re-enable ActiveX controls in Microsoft Office 2007 and Microsoft Office 2010, perform the following steps:</p>
<ol>
<li>Click File, click Options, click Trust Center, and then click Trust Center Settings.</li>
<li>Click ActiveX Settings in the left-hand pane, and then deselect Disable all controls without notifications.</li>
<li>Click OK to save your settings.
<strong>Set Internet and Local intranet security zone settings to "High" to block ActiveX Controls and Active Scripting in these zones</strong>
You can help protect against exploitation of these vulnerabilities by changing your settings for the Internet security zone to block ActiveX controls and Active Scripting. You can do this by setting your browser security to High.</li>
</ol>
<p>To raise the browsing security level in Internet Explorer, perform the following steps:</p>
<ol>
<li>On the Internet Explorer <strong>Tools</strong> menu, click** Internet Option**s.</li>
<li>In the <strong>Internet Options</strong> dialog box, click the <strong>Security</strong> tab, and then click <strong>Internet</strong>.</li>
<li>Under <strong>Security level for this zone</strong>, move the slider to <strong>High</strong>. This sets the security level for all websites you visit to High.</li>
<li>Click <strong>Local intranet</strong>.</li>
<li>Under <strong>Security level for this zone</strong>, move the slider to <strong>High</strong>. This sets the security level for all websites you visit to High.</li>
<li>Click <strong>OK</strong> to accept the changes and return to Internet Explorer.
<strong>Note</strong> If no slider is visible, click <strong>Default Level</strong>, and then move the slider to <strong>High</strong>.
<strong>Note</strong> Setting the level to High may cause some websites to work incorrectly. If you have difficulty using a website after you change this setting, and you are sure the site is safe to use, you can add that site to your list of trusted sites. This will allow the site to work correctly even with the security setting set to High.
<strong>Impact of workaround</strong>. There are side effects to blocking ActiveX Controls and Active Scripting. Many websites on the Internet or an intranet use ActiveX or Active Scripting to provide additional functionality. For example, an online e-commerce site or banking site may use ActiveX Controls to provide menus, ordering forms, or even account statements. Blocking ActiveX Controls or Active Scripting is a global setting that affects all Internet and intranet sites. If you do not want to block ActiveX Controls or Active Scripting for such sites, use the steps outlined in "Add sites that you trust to the Internet Explorer Trusted sites zone".
<strong>Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone</strong></li>
</ol>
<p>You can help protect against exploitation of these vulnerabilities by changing your settings to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone. To do this, perform the following steps:</p>
<ol>
<li>In Internet Explorer, click <strong>Internet Options</strong> on the <strong>Tools</strong> menu.</li>
<li>Click the <strong>Security</strong> tab.</li>
<li>Click <strong>Internet</strong>, and then click <strong>Custom Level</strong>.</li>
<li>Under <strong>Settings</strong>, in the <strong>Scripting</strong> section, under <strong>Active Scripting</strong>, click <strong>Prompt</strong> or <strong>Disable</strong>, and then click <strong>OK</strong>.</li>
<li>Click <strong>Local intranet</strong>, and then click <strong>Custom Level</strong>.</li>
<li>Under <strong>Settings</strong>, in the <strong>Scripting</strong> section, under <strong>Active Scripting</strong>, click <strong>Prompt</strong> or <strong>Disable</strong>, and then click <strong>OK</strong>.</li>
<li>Click <strong>OK</strong> to return to Internet Explorer, and then click <strong>OK</strong> again.
<strong>Note</strong> Disabling Active Scripting in the Internet and Local intranet security zones may cause some websites to work incorrectly. If you have difficulty using a website after you change this setting, and you are sure the site is safe to use, you can add that site to your list of trusted sites. This will allow the site to work correctly.
<strong>Impact of workaround</strong>. There are side effects to prompting before running Active Scripting. Many websites that are on the Internet or on an intranet use Active Scripting to provide additional functionality. For example, an online e-commerce site or banking site may use Active Scripting to provide menus, ordering forms, or even account statements. Prompting before running Active Scripting is a global setting that affects all Internet and intranet sites. You will be prompted frequently when you enable this workaround. For each prompt, if you feel you trust the site that you are visiting, click <strong>Yes</strong> to run Active Scripting. If you do not want to be prompted for all these sites, use the steps outlined in "Add sites that you trust to the Internet Explorer Trusted sites zone".
<strong>Add sites that you trust to the Internet Explorer Trusted sites zone</strong>
After you set Internet Explorer to require a prompt before it runs ActiveX controls and Active Scripting in the Internet zone and in the Local intranet zone, you can add sites that you trust to the Internet Explorer Trusted sites zone. This will allow you to continue to use trusted websites exactly as you do today, while helping to protect you from this attack on untrusted sites. We recommend that you add only sites that you trust to the Trusted sites zone.</li>
</ol>
<p>To do this, perform the following steps:</p>
<ol>
<li>In Internet Explorer, click <strong>Tools</strong>, click <strong>Internet Options</strong>, and then click the <strong>Security</strong> tab.</li>
<li>In the <strong>Select a web content zone to specify its current security settings</strong> box, click <strong>Trusted Sites</strong>, and then click <strong>Sites</strong>.</li>
<li>If you want to add sites that do not require an encrypted channel, click to clear the <strong>Require server verification (https:) for all sites in this zone</strong> check box.</li>
<li>In the <strong>Add this website to the zone</strong> box, type the URL of a site that you trust, and then click <strong>Add</strong>.</li>
<li>Repeat these steps for each site that you want to add to the zone.</li>
<li>Click <strong>OK</strong> two times to accept the changes and return to Internet Explorer.
<strong>Note</strong> Add any sites that you trust not to take malicious action on your system. Two sites in particular that you may want to add are *<strong>.windowsupdate.microsoft.com</strong> and *<strong>.update.microsoft.com</strong>. These are the sites that will host the update, and they require an ActiveX control to install the update.</li>
</ol>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Microsoft Office Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p>
<p>Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.</p>
<p>Note that the Preview Pane is not an attack vector for this vulnerability.</p>
<p>The security update addresses the vulnerability by correcting how Office handles objects in memory.</p>
<p>As of May 16, 2017, the 3212221 update is available for Microsoft Office for Mac 2011. For more information, see <a href="https://support.microsoft.com/en-us/help/3212221">Microsoft Knowledge Base Article 3212221</a>.</p>
Microsoft Office
CVE-2017-0264
10026
Remote Code Execution
10026
Important
10026
Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A;Older Software Release:Exploitation Unlikely
3212221
http://go.microsoft.com/fwlink/?LinkId=847738
10026
No
Security Update
Jin Chen of <a href="https://www.paloaltonetworks.com/">Palo Alto Networks</a>
2.0
2017-05-16T07:00:00Z
<p>CVE information revised to announce the availability of the 14.7.4 update for Microsoft Office for Mac 2011 (3212221). Customers running affected Mac software should install the appropriate update for their product to be protected from the vulnerability discussed in this CVE. Customers running other Microsoft Office software do not need to take any action. See <a href="https://support.microsoft.com/en-us/help/3212221">Microsoft Knowledge Base Article 3212221</a> for more information and download links.</p>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Microsoft Office Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p>
<p>Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.</p>
<p>Note that the Preview Pane is not an attack vector for this vulnerability.</p>
<p>The security update addresses the vulnerability by correcting how Office handles objects in memory.</p>
<p>As of May 16, 2017, the 3212221 update is available for Microsoft Office for Mac 2011. For more information, see <a href="https://support.microsoft.com/en-us/help/3212221">Microsoft Knowledge Base Article 3212221</a>.</p>
Microsoft Office
CVE-2017-0265
10026
Remote Code Execution
10026
Important
10026
Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A;Older Software Release:Exploitation Unlikely
3212221
http://go.microsoft.com/fwlink/?LinkId=847738
10026
No
Security Update
Jin Chen of <a href="https://www.paloaltonetworks.com/">Palo Alto Networks</a>
2.0
2017-05-16T07:00:00Z
<p>CVE information revised to announce the availability of the 14.7.4 update for Microsoft Office for Mac 2011 (3212221). Customers running affected Mac software should install the appropriate update for their product to be protected from the vulnerability discussed in this CVE. Customers running other Microsoft Office software do not need to take any action. See <a href="https://support.microsoft.com/en-us/help/3212221">Microsoft Knowledge Base Article 3212221</a> for more information and download links.</p>
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Scripting Engine Memory Corruption Vulnerability
<p>A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p>
<p>The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.</p>
Microsoft Edge
CVE-2017-0266
10724-10789
10724-10788
10724-10852
10724-10853
10724-10951
10724-10952
Remote Code Execution
10724-10789
Remote Code Execution
10724-10788
Remote Code Execution
10724-10852
Remote Code Execution
10724-10853
Remote Code Execution
10724-10951
Remote Code Execution
10724-10952
Critical
10724-10789
Critical
10724-10788
Critical
10724-10852
Critical
10724-10853
Critical
10724-10951
Critical
10724-10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10789
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10788
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10852
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10853
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10951
4.2
3.8
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C
10724-10952
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10724-10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10724-10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10724-10952
Yes
Security Update
Anonymous working with <a href="http://www.zerodayinitiative.com/">Trend Micro's Zero Day Initiative</a>
Qixun Zhao www.weibo.com/babyboaes Qihoo 360 Vulcan Team http://www.360.cn/
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
Windows SMB Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited this vulnerability could craft a special packet, which could lead to information disclosure from the server.</p>
<p>To exploit the vulnerability, in most situations, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv1 server.</p>
<p>The security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.</p>
Windows SMB Server
CVE-2017-0267
10729
10735
10789
10788
10852
10853
10047
10048
10481
10482
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
10951
10952
Information Disclosure
10729
Information Disclosure
10735
Information Disclosure
10789
Information Disclosure
10788
Information Disclosure
10852
Information Disclosure
10853
Information Disclosure
10047
Information Disclosure
10048
Information Disclosure
10481
Information Disclosure
10482
Information Disclosure
9312
Information Disclosure
10287
Information Disclosure
9311
Information Disclosure
9318
Information Disclosure
9344
Information Disclosure
10050
Information Disclosure
10051
Information Disclosure
10049
Information Disclosure
10378
Information Disclosure
10379
Information Disclosure
10483
Information Disclosure
10543
Information Disclosure
10816
Information Disclosure
10855
Information Disclosure
10951
Information Disclosure
10952
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10047
Important
10048
Important
10481
Important
10482
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10816
Important
10855
Important
10951
Important
10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10729
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10735
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10789
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10788
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10852
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10853
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10047
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10048
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10481
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10482
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9312
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10287
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9311
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9318
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9344
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10050
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10051
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10049
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10378
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10379
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10483
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10543
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10816
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10855
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10951
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9312
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
10287
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9311
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9318
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
<p><strong>Disable SMBv1</strong></p>
<p><strong>For customers running Windows Vista and later</strong>
<a href="https://support.microsoft.com/kb/2696547">See Microsoft Knowledge Base Article 2696547</a>.</p>
<p><strong>Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later</strong>
For client operating systems:</p>
<ol>
<li>Open <strong>Control Panel</strong>, click <strong>Programs</strong>, and then click <strong>Turn Windows features on or off</strong>.</li>
<li>In the <strong>Windows Features</strong> window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> checkbox, and then click <strong>OK</strong> to close the window.</li>
<li>Restart the system.</li>
</ol>
<p>For server operating systems:</p>
<ol>
<li>Open <strong>Server Manager</strong> and then click the <strong>Manage</strong> menu and select <strong>Remove Roles and Features</strong>.</li>
<li>In the Features window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> check box, and then click OK to close the window.</li>
<li>Restart the system.</li>
</ol>
<p><strong>Impact of workaround.</strong>
The SMBv1 protocol will be disabled on the target system.</p>
<p><strong>How to undo the workaround</strong>.
Retrace the workaround steps, and select the <strong>SMB1.0/CIFS File Sharing Support</strong> check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.</p>
Nicolas Joly of MSRC Vulnerabilities & Mitigations
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows SMB Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited this vulnerability could craft a special packet, which could lead to information disclosure from the server.</p>
<p>To exploit the vulnerability, in most situations, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv1 server.</p>
<p>The security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.</p>
Windows SMB Server
CVE-2017-0268
10729
10735
10789
10788
10852
10853
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
10951
10952
Information Disclosure
10729
Information Disclosure
10735
Information Disclosure
10789
Information Disclosure
10788
Information Disclosure
10852
Information Disclosure
10853
Information Disclosure
10047
Information Disclosure
10048
Information Disclosure
10481
Information Disclosure
10482
Information Disclosure
10484
Information Disclosure
9312
Information Disclosure
10287
Information Disclosure
9311
Information Disclosure
9318
Information Disclosure
9344
Information Disclosure
10050
Information Disclosure
10051
Information Disclosure
10049
Information Disclosure
10378
Information Disclosure
10379
Information Disclosure
10483
Information Disclosure
10543
Information Disclosure
10816
Information Disclosure
10855
Information Disclosure
10951
Information Disclosure
10952
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10816
Important
10855
Important
10951
Important
10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10729
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10735
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10789
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10788
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10852
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10853
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10047
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10048
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10481
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10482
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10484
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9312
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10287
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9311
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9318
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9344
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10050
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10051
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10049
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10378
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10379
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10483
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10543
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10816
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10855
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10951
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9312
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
10287
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9311
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9318
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
<p><strong>Disable SMBv1</strong></p>
<p><strong>For customers running Windows Vista and later</strong>
<a href="https://support.microsoft.com/kb/2696547">See Microsoft Knowledge Base Article 2696547</a>.</p>
<p><strong>Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later</strong>
For client operating systems:</p>
<ol>
<li>Open <strong>Control Panel</strong>, click <strong>Programs</strong>, and then click <strong>Turn Windows features on or off</strong>.</li>
<li>In the <strong>Windows Features</strong> window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> checkbox, and then click <strong>OK</strong> to close the window.</li>
<li>Restart the system.</li>
</ol>
<p>For server operating systems:</p>
<ol>
<li>Open <strong>Server Manager</strong> and then click the <strong>Manage</strong> menu and select <strong>Remove Roles and Features</strong>.</li>
<li>In the Features window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> check box, and then click OK to close the window.</li>
<li>Restart the system.</li>
</ol>
<p><strong>Impact of workaround.</strong>
The SMBv1 protocol will be disabled on the target system.</p>
<p><strong>How to undo the workaround</strong>.
Retrace the workaround steps, and select the <strong>SMB1.0/CIFS File Sharing Support</strong> check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.</p>
Nicolas Joly of MSRC Vulnerabilities & Mitigations
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows SMB Denial of Service Vulnerability
<p>A denial of service vulnerability exists in the Microsoft Server Block Message (SMB) when an attacker sends specially crafted requests to the server. An attacker who exploited this vulnerability could cause the affected system to stop responding until it is manually restarted. To attempt to exploit this issue, an attacker would need to send specially crafted SMB requests to the target system.</p>
<p>Note that the denial of service vulnerability would not allow an attacker to execute code or to elevate their user rights, but it could cause the affected system to stop accepting requests.</p>
<p>The security update addresses the vulnerability by correcting the manner in which SMB handles specially crafted client requests.</p>
Windows SMB Server
CVE-2017-0269
10729
10735
10789
10788
10852
10853
10047
10048
10481
10482
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
10951
10952
Denial of Service
10729
Denial of Service
10735
Denial of Service
10789
Denial of Service
10788
Denial of Service
10852
Denial of Service
10853
Denial of Service
10047
Denial of Service
10048
Denial of Service
10481
Denial of Service
10482
Denial of Service
9312
Denial of Service
10287
Denial of Service
9311
Denial of Service
9318
Denial of Service
9344
Denial of Service
10050
Denial of Service
10051
Denial of Service
10049
Denial of Service
10378
Denial of Service
10379
Denial of Service
10483
Denial of Service
10543
Denial of Service
10816
Denial of Service
10855
Denial of Service
10951
Denial of Service
10952
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10047
Important
10048
Important
10481
Important
10482
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10816
Important
10855
Important
10951
Important
10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10729
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10735
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10789
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10788
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10852
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10853
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10047
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10048
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10481
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10482
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9312
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10287
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9311
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9318
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9344
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10050
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10051
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10049
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10378
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10379
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10483
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10543
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10816
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10855
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10951
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9312
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
10287
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9311
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9318
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
<p><strong>Disable SMBv1</strong></p>
<p><strong>For customers running Windows Vista and later</strong>
<a href="https://support.microsoft.com/kb/2696547">See Microsoft Knowledge Base Article 2696547</a>.</p>
<p><strong>Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later</strong>
For client operating systems:</p>
<ol>
<li>Open <strong>Control Panel</strong>, click <strong>Programs</strong>, and then click <strong>Turn Windows features on or off</strong>.</li>
<li>In the <strong>Windows Features</strong> window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> checkbox, and then click <strong>OK</strong> to close the window.</li>
<li>Restart the system.</li>
</ol>
<p>For server operating systems:</p>
<ol>
<li>Open <strong>Server Manager</strong> and then click the <strong>Manage</strong> menu and select <strong>Remove Roles and Features</strong>.</li>
<li>In the Features window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> check box, and then click OK to close the window.</li>
<li>Restart the system.</li>
</ol>
<p><strong>Impact of workaround.</strong>
The SMBv1 protocol will be disabled on the target system.</p>
<p><strong>How to undo the workaround</strong>.
Retrace the workaround steps, and select the <strong>SMB1.0/CIFS File Sharing Support</strong> check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.</p>
Nicolas Joly of MSRC Vulnerabilities & Mitigations
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows SMB Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited this vulnerability could craft a special packet, which could lead to information disclosure from the server.</p>
<p>To exploit the vulnerability, in most situations, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv1 server.</p>
<p>The security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.</p>
Windows SMB Server
CVE-2017-0270
10729
10735
10789
10788
10852
10853
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10951
10952
10816
10855
Information Disclosure
10729
Information Disclosure
10735
Information Disclosure
10789
Information Disclosure
10788
Information Disclosure
10852
Information Disclosure
10853
Information Disclosure
10047
Information Disclosure
10048
Information Disclosure
10481
Information Disclosure
10482
Information Disclosure
10484
Information Disclosure
9312
Information Disclosure
10287
Information Disclosure
9311
Information Disclosure
9318
Information Disclosure
9344
Information Disclosure
10050
Information Disclosure
10051
Information Disclosure
10049
Information Disclosure
10378
Information Disclosure
10379
Information Disclosure
10483
Information Disclosure
10543
Information Disclosure
10951
Information Disclosure
10952
Information Disclosure
10816
Information Disclosure
10855
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10951
Important
10952
Important
10816
Important
10855
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10729
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10735
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10789
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10788
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10852
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10853
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10047
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10048
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10481
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10482
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10484
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9312
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10287
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9311
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9318
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9344
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10050
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10051
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10049
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10378
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10379
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10483
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10543
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10951
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10952
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10816
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10855
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9312
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
10287
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9311
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9318
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
<p><strong>Disable SMBv1</strong></p>
<p><strong>For customers running Windows Vista and later</strong>
<a href="https://support.microsoft.com/kb/2696547">See Microsoft Knowledge Base Article 2696547</a>.</p>
<p><strong>Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later</strong>
For client operating systems:</p>
<ol>
<li>Open <strong>Control Panel</strong>, click <strong>Programs</strong>, and then click <strong>Turn Windows features on or off</strong>.</li>
<li>In the <strong>Windows Features</strong> window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> checkbox, and then click <strong>OK</strong> to close the window.</li>
<li>Restart the system.</li>
</ol>
<p>For server operating systems:</p>
<ol>
<li>Open <strong>Server Manager</strong> and then click the <strong>Manage</strong> menu and select <strong>Remove Roles and Features</strong>.</li>
<li>In the Features window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> check box, and then click OK to close the window.</li>
<li>Restart the system.</li>
</ol>
<p><strong>Impact of workaround.</strong>
The SMBv1 protocol will be disabled on the target system.</p>
<p><strong>How to undo the workaround</strong>.
Retrace the workaround steps, and select the <strong>SMB1.0/CIFS File Sharing Support</strong> check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.</p>
Nicolas Joly of MSRC Vulnerabilities & Mitigations
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows SMB Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited this vulnerability could craft a special packet, which could lead to information disclosure from the server.</p>
<p>To exploit the vulnerability, in most situations, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv1 server.</p>
<p>The security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.</p>
Windows SMB Server
CVE-2017-0271
10729
10735
10789
10788
10852
10853
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10951
10952
10816
10855
Information Disclosure
10729
Information Disclosure
10735
Information Disclosure
10789
Information Disclosure
10788
Information Disclosure
10852
Information Disclosure
10853
Information Disclosure
10047
Information Disclosure
10048
Information Disclosure
10481
Information Disclosure
10482
Information Disclosure
10484
Information Disclosure
9312
Information Disclosure
10287
Information Disclosure
9311
Information Disclosure
9318
Information Disclosure
9344
Information Disclosure
10050
Information Disclosure
10051
Information Disclosure
10049
Information Disclosure
10378
Information Disclosure
10379
Information Disclosure
10483
Information Disclosure
10543
Information Disclosure
10951
Information Disclosure
10952
Information Disclosure
10816
Information Disclosure
10855
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10951
Important
10952
Important
10816
Important
10855
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10729
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10735
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10789
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10788
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10852
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10853
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10047
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10048
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10481
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10482
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10484
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9312
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10287
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9311
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9318
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9344
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10050
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10051
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10049
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10378
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10379
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10483
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10543
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10951
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10952
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10816
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10855
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9312
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
10287
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9311
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9318
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
<p><strong>Disable SMBv1</strong></p>
<p><strong>For customers running Windows Vista and later</strong>
<a href="https://support.microsoft.com/kb/2696547">See Microsoft Knowledge Base Article 2696547</a>.</p>
<p><strong>Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later</strong>
For client operating systems:</p>
<ol>
<li>Open <strong>Control Panel</strong>, click <strong>Programs</strong>, and then click <strong>Turn Windows features on or off</strong>.</li>
<li>In the <strong>Windows Features</strong> window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> checkbox, and then click <strong>OK</strong> to close the window.</li>
<li>Restart the system.</li>
</ol>
<p>For server operating systems:</p>
<ol>
<li>Open <strong>Server Manager</strong> and then click the <strong>Manage</strong> menu and select <strong>Remove Roles and Features</strong>.</li>
<li>In the Features window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> check box, and then click OK to close the window.</li>
<li>Restart the system.</li>
</ol>
<p><strong>Impact of workaround.</strong>
The SMBv1 protocol will be disabled on the target system.</p>
<p><strong>How to undo the workaround</strong>.
Retrace the workaround steps, and select the <strong>SMB1.0/CIFS File Sharing Support</strong> check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.</p>
Nicolas Joly of MSRC Vulnerabilities & Mitigations
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows SMB Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server.</p>
<p>To exploit the vulnerability, in most situations, an authenticated attacker could send a specially crafted packet to a targeted SMBv1 server.</p>
<p>The security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.</p>
Windows SMB Server
CVE-2017-0272
10729
10735
10789
10788
10852
10853
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
10951
10952
Remote Code Execution
10729
Remote Code Execution
10735
Remote Code Execution
10789
Remote Code Execution
10788
Remote Code Execution
10852
Remote Code Execution
10853
Remote Code Execution
10047
Remote Code Execution
10048
Remote Code Execution
10481
Remote Code Execution
10482
Remote Code Execution
10484
Remote Code Execution
9312
Remote Code Execution
10287
Remote Code Execution
9311
Remote Code Execution
9318
Remote Code Execution
9344
Remote Code Execution
10050
Remote Code Execution
10051
Remote Code Execution
10049
Remote Code Execution
10378
Remote Code Execution
10379
Remote Code Execution
10483
Remote Code Execution
10543
Remote Code Execution
10816
Remote Code Execution
10855
Remote Code Execution
10951
Remote Code Execution
10952
Critical
10729
Critical
10735
Critical
10789
Critical
10788
Critical
10852
Critical
10853
Critical
10047
Critical
10048
Critical
10481
Critical
10482
Critical
10484
Critical
9312
Critical
10287
Critical
9311
Critical
9318
Critical
9344
Critical
10050
Critical
10051
Critical
10049
Critical
10378
Critical
10379
Critical
10483
Critical
10543
Critical
10816
Critical
10855
Critical
10951
Critical
10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10729
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10735
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10789
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10788
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10852
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10853
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10047
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10048
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10481
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10482
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10484
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9312
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10287
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9311
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9318
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9344
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10050
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10051
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10049
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10378
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10379
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10483
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10543
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10816
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10855
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10951
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9312
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
10287
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9311
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9318
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
<p><strong>Disable SMBv1</strong></p>
<p><strong>For customers running Windows Vista and later</strong>
<a href="https://support.microsoft.com/kb/2696547">See Microsoft Knowledge Base Article 2696547</a>.</p>
<p><strong>Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later</strong>
For client operating systems:</p>
<ol>
<li>Open <strong>Control Panel</strong>, click <strong>Programs</strong>, and then click <strong>Turn Windows features on or off</strong>.</li>
<li>In the <strong>Windows Features</strong> window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> checkbox, and then click <strong>OK</strong> to close the window.</li>
<li>Restart the system.</li>
</ol>
<p>For server operating systems:</p>
<ol>
<li>Open <strong>Server Manager</strong> and then click the <strong>Manage</strong> menu and select <strong>Remove Roles and Features</strong>.</li>
<li>In the Features window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> check box, and then click OK to close the window.</li>
<li>Restart the system.</li>
</ol>
<p><strong>Impact of workaround.</strong>
The SMBv1 protocol will be disabled on the target system.</p>
<p><strong>How to undo the workaround</strong>.
Retrace the workaround steps, and select the <strong>SMB1.0/CIFS File Sharing Support</strong> check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.</p>
Nicolas Joly of MSRC Vulnerabilities & Mitigations
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows SMB Denial of Service Vulnerability
<p>A denial of service vulnerability exists in the Microsoft Server Block Message (SMB) when an attacker sends specially crafted requests to the server. An attacker who exploited this vulnerability could cause the affected system to stop responding until it is manually restarted. To attempt to exploit this issue, an attacker would need to send specially crafted SMB requests to the target system.</p>
<p>Note that the denial of service vulnerability would not allow an attacker to execute code or to elevate their user rights, but it could cause the affected system to stop accepting requests.</p>
<p>The security update addresses the vulnerability by correcting the manner in which SMB handles specially crafted client requests.</p>
Windows SMB Server
CVE-2017-0273
10729
10735
10789
10788
10852
10853
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
10951
10952
Denial of Service
10729
Denial of Service
10735
Denial of Service
10789
Denial of Service
10788
Denial of Service
10852
Denial of Service
10853
Denial of Service
10047
Denial of Service
10048
Denial of Service
10481
Denial of Service
10482
Denial of Service
10484
Denial of Service
9312
Denial of Service
10287
Denial of Service
9311
Denial of Service
9318
Denial of Service
9344
Denial of Service
10050
Denial of Service
10051
Denial of Service
10049
Denial of Service
10378
Denial of Service
10379
Denial of Service
10483
Denial of Service
10543
Denial of Service
10816
Denial of Service
10855
Denial of Service
10951
Denial of Service
10952
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10816
Important
10855
Important
10951
Important
10952
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10729
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10735
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10789
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10788
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10852
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10853
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10047
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10048
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10481
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10482
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10484
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9312
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10287
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9311
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9318
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
9344
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10050
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10051
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10049
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10378
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10379
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10483
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10543
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10816
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10855
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10951
8.1
7.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
10952
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9312
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
10287
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9311
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9318
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
<p><strong>Disable SMBv1</strong></p>
<p><strong>For customers running Windows Vista and later</strong>
<a href="https://support.microsoft.com/kb/2696547">See Microsoft Knowledge Base Article 2696547</a>.</p>
<p><strong>Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later</strong>
For client operating systems:</p>
<ol>
<li>Open <strong>Control Panel</strong>, click <strong>Programs</strong>, and then click <strong>Turn Windows features on or off</strong>.</li>
<li>In the <strong>Windows Features</strong> window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> checkbox, and then click <strong>OK</strong> to close the window.</li>
<li>Restart the system.</li>
</ol>
<p>For server operating systems:</p>
<ol>
<li>Open <strong>Server Manager</strong> and then click the <strong>Manage</strong> menu and select <strong>Remove Roles and Features</strong>.</li>
<li>In the Features window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> check box, and then click OK to close the window.</li>
<li>Restart the system.</li>
</ol>
<p><strong>Impact of workaround.</strong>
The SMBv1 protocol will be disabled on the target system.</p>
<p><strong>How to undo the workaround</strong>.
Retrace the workaround steps, and select the <strong>SMB1.0/CIFS File Sharing Support</strong> check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.</p>
Swamy Shivaganga Nagaraju of MSRC Vulnerabilities & Mitigations
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows SMB Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited this vulnerability could craft a special packet, which could lead to information disclosure from the server.</p>
<p>To exploit the vulnerability, in most situations, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv1 server.</p>
<p>The security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.</p>
Windows SMB Server
CVE-2017-0274
10729
10735
10789
10788
10852
10853
10951
10952
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
Information Disclosure
10729
Information Disclosure
10735
Information Disclosure
10789
Information Disclosure
10788
Information Disclosure
10852
Information Disclosure
10853
Information Disclosure
10951
Information Disclosure
10952
Information Disclosure
10047
Information Disclosure
10048
Information Disclosure
10481
Information Disclosure
10482
Information Disclosure
10484
Information Disclosure
9312
Information Disclosure
10287
Information Disclosure
9311
Information Disclosure
9318
Information Disclosure
9344
Information Disclosure
10050
Information Disclosure
10051
Information Disclosure
10049
Information Disclosure
10378
Information Disclosure
10379
Information Disclosure
10483
Information Disclosure
10543
Information Disclosure
10816
Information Disclosure
10855
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10951
Important
10952
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10816
Important
10855
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10729
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10735
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10789
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10788
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10852
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10853
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10951
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10952
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10047
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10048
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10481
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10482
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10484
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9312
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10287
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9311
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9318
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9344
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10050
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10051
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10049
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10378
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10379
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10483
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10543
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10816
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10855
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9312
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
10287
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9311
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9318
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
<p><strong>Disable SMBv1</strong></p>
<p><strong>For customers running Windows Vista and later</strong>
<a href="https://support.microsoft.com/kb/2696547">See Microsoft Knowledge Base Article 2696547</a>.</p>
<p><strong>Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later</strong>
For client operating systems:</p>
<ol>
<li>Open <strong>Control Panel</strong>, click <strong>Programs</strong>, and then click <strong>Turn Windows features on or off</strong>.</li>
<li>In the <strong>Windows Features</strong> window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> checkbox, and then click <strong>OK</strong> to close the window.</li>
<li>Restart the system.</li>
</ol>
<p>For server operating systems:</p>
<ol>
<li>Open <strong>Server Manager</strong> and then click the <strong>Manage</strong> menu and select <strong>Remove Roles and Features</strong>.</li>
<li>In the Features window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> check box, and then click OK to close the window.</li>
<li>Restart the system.</li>
</ol>
<p><strong>Impact of workaround.</strong>
The SMBv1 protocol will be disabled on the target system.</p>
<p><strong>How to undo the workaround</strong>.
Retrace the workaround steps, and select the <strong>SMB1.0/CIFS File Sharing Support</strong> check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.</p>
WDG Offensive Security Research Team and MSRC Vulnerabilities & Mitigations
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows SMB Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited this vulnerability could craft a special packet, which could lead to information disclosure from the server.</p>
<p>To exploit the vulnerability, in most situations, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv1 server.</p>
<p>The security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.</p>
Windows SMB Server
CVE-2017-0275
10729
10735
10789
10788
10852
10853
10951
10952
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
Information Disclosure
10729
Information Disclosure
10735
Information Disclosure
10789
Information Disclosure
10788
Information Disclosure
10852
Information Disclosure
10853
Information Disclosure
10951
Information Disclosure
10952
Information Disclosure
10047
Information Disclosure
10048
Information Disclosure
10481
Information Disclosure
10482
Information Disclosure
10484
Information Disclosure
9312
Information Disclosure
10287
Information Disclosure
9311
Information Disclosure
9318
Information Disclosure
9344
Information Disclosure
10050
Information Disclosure
10051
Information Disclosure
10049
Information Disclosure
10378
Information Disclosure
10379
Information Disclosure
10483
Information Disclosure
10543
Information Disclosure
10816
Information Disclosure
10855
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10951
Important
10952
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10816
Important
10855
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10729
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10735
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10789
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10788
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10852
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10853
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10951
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10952
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10047
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10048
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10481
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10482
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10484
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9312
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10287
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9311
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9318
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9344
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10050
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10051
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10049
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10378
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10379
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10483
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10543
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10816
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10855
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9312
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
10287
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9311
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9318
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
<p><strong>Disable SMBv1</strong></p>
<p><strong>For customers running Windows Vista and later</strong>
<a href="https://support.microsoft.com/kb/2696547">See Microsoft Knowledge Base Article 2696547</a>.</p>
<p><strong>Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later</strong>
For client operating systems:</p>
<ol>
<li>Open <strong>Control Panel</strong>, click <strong>Programs</strong>, and then click <strong>Turn Windows features on or off</strong>.</li>
<li>In the <strong>Windows Features</strong> window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> checkbox, and then click <strong>OK</strong> to close the window.</li>
<li>Restart the system.</li>
</ol>
<p>For server operating systems:</p>
<ol>
<li>Open <strong>Server Manager</strong> and then click the <strong>Manage</strong> menu and select <strong>Remove Roles and Features</strong>.</li>
<li>In the Features window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> check box, and then click OK to close the window.</li>
<li>Restart the system.</li>
</ol>
<p><strong>Impact of workaround.</strong>
The SMBv1 protocol will be disabled on the target system.</p>
<p><strong>How to undo the workaround</strong>.
Retrace the workaround steps, and select the <strong>SMB1.0/CIFS File Sharing Support</strong> check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.</p>
Nicolas Joly of MSRC Vulnerabilities & Mitigations
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows SMB Information Disclosure Vulnerability
<p>An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited this vulnerability could craft a special packet, which could lead to information disclosure from the server.</p>
<p>To exploit the vulnerability, in most situations, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv1 server.</p>
<p>The security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.</p>
Windows SMB Server
CVE-2017-0276
10729
10735
10789
10788
10852
10853
10951
10952
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
Information Disclosure
10729
Information Disclosure
10735
Information Disclosure
10789
Information Disclosure
10788
Information Disclosure
10852
Information Disclosure
10853
Information Disclosure
10951
Information Disclosure
10952
Information Disclosure
10047
Information Disclosure
10048
Information Disclosure
10481
Information Disclosure
10482
Information Disclosure
10484
Information Disclosure
9312
Information Disclosure
10287
Information Disclosure
9311
Information Disclosure
9318
Information Disclosure
9344
Information Disclosure
10050
Information Disclosure
10051
Information Disclosure
10049
Information Disclosure
10378
Information Disclosure
10379
Information Disclosure
10483
Information Disclosure
10543
Information Disclosure
10816
Information Disclosure
10855
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10951
Important
10952
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10816
Important
10855
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10729
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10735
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10789
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10788
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10852
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10853
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10951
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10952
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10047
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10048
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10481
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10482
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10484
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9312
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10287
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9311
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9318
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9344
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10050
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10051
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10049
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10378
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10379
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10483
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10543
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10816
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10855
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9312
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
10287
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9311
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9318
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
<p><strong>Disable SMBv1</strong></p>
<p><strong>For customers running Windows Vista and later</strong>
<a href="https://support.microsoft.com/kb/2696547">See Microsoft Knowledge Base Article 2696547</a>.</p>
<p><strong>Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later</strong>
For client operating systems:</p>
<ol>
<li>Open <strong>Control Panel</strong>, click <strong>Programs</strong>, and then click <strong>Turn Windows features on or off</strong>.</li>
<li>In the <strong>Windows Features</strong> window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> checkbox, and then click <strong>OK</strong> to close the window.</li>
<li>Restart the system.</li>
</ol>
<p>For server operating systems:</p>
<ol>
<li>Open <strong>Server Manager</strong> and then click the <strong>Manage</strong> menu and select <strong>Remove Roles and Features</strong>.</li>
<li>In the Features window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> check box, and then click OK to close the window.</li>
<li>Restart the system.</li>
</ol>
<p><strong>Impact of workaround.</strong>
The SMBv1 protocol will be disabled on the target system.</p>
<p><strong>How to undo the workaround</strong>.
Retrace the workaround steps, and select the <strong>SMB1.0/CIFS File Sharing Support</strong> check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.</p>
Viktor Brange of WDG Offensive Security Research Team
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows SMB Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server.</p>
<p>To exploit the vulnerability, in most situations, an authenticated attacker could send a specially crafted packet to a targeted SMBv1 server.</p>
<p>The security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.</p>
Windows SMB Server
CVE-2017-0277
10729
10735
10789
10788
10852
10853
10951
10952
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
Remote Code Execution
10729
Remote Code Execution
10735
Remote Code Execution
10789
Remote Code Execution
10788
Remote Code Execution
10852
Remote Code Execution
10853
Remote Code Execution
10951
Remote Code Execution
10952
Remote Code Execution
10047
Remote Code Execution
10048
Remote Code Execution
10481
Remote Code Execution
10482
Remote Code Execution
10484
Remote Code Execution
9312
Remote Code Execution
10287
Remote Code Execution
9311
Remote Code Execution
9318
Remote Code Execution
9344
Remote Code Execution
10050
Remote Code Execution
10051
Remote Code Execution
10049
Remote Code Execution
10378
Remote Code Execution
10379
Remote Code Execution
10483
Remote Code Execution
10543
Remote Code Execution
10816
Remote Code Execution
10855
Critical
10729
Critical
10735
Critical
10789
Critical
10788
Critical
10852
Critical
10853
Critical
10951
Critical
10952
Critical
10047
Critical
10048
Critical
10481
Critical
10482
Critical
10484
Critical
9312
Critical
10287
Critical
9311
Critical
9318
Critical
9344
Critical
10050
Critical
10051
Critical
10049
Critical
10378
Critical
10379
Critical
10483
Critical
10543
Critical
10816
Critical
10855
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10729
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10735
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10789
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10788
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10852
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10853
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10951
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10952
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10047
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10048
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10481
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10482
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10484
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9312
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10287
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9311
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9318
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9344
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10050
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10051
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10049
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10378
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10379
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10483
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10543
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10816
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10855
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9312
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
10287
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9311
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9318
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
<p><strong>Disable SMBv1</strong></p>
<p><strong>For customers running Windows Vista and later</strong>
<a href="https://support.microsoft.com/kb/2696547">See Microsoft Knowledge Base Article 2696547</a>.</p>
<p><strong>Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later</strong>
For client operating systems:</p>
<ol>
<li>Open <strong>Control Panel</strong>, click <strong>Programs</strong>, and then click <strong>Turn Windows features on or off</strong>.</li>
<li>In the <strong>Windows Features</strong> window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> checkbox, and then click <strong>OK</strong> to close the window.</li>
<li>Restart the system.</li>
</ol>
<p>For server operating systems:</p>
<ol>
<li>Open <strong>Server Manager</strong> and then click the <strong>Manage</strong> menu and select <strong>Remove Roles and Features</strong>.</li>
<li>In the Features window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> check box, and then click OK to close the window.</li>
<li>Restart the system.</li>
</ol>
<p><strong>Impact of workaround.</strong>
The SMBv1 protocol will be disabled on the target system.</p>
<p><strong>How to undo the workaround</strong>.
Retrace the workaround steps, and select the <strong>SMB1.0/CIFS File Sharing Support</strong> check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.</p>
Viktor Brange of WDG Offensive Security Research Team and Swamy Shivaganga Nagaraju of MSRC Vulnerabilities & Mitigations
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows SMB Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server.</p>
<p>To exploit the vulnerability, in most situations, an authenticated attacker could send a specially crafted packet to a targeted SMBv1 server.</p>
<p>The security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.</p>
Windows SMB Server
CVE-2017-0278
10729
10735
10789
10788
10852
10853
10951
10952
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
Remote Code Execution
10729
Remote Code Execution
10735
Remote Code Execution
10789
Remote Code Execution
10788
Remote Code Execution
10852
Remote Code Execution
10853
Remote Code Execution
10951
Remote Code Execution
10952
Remote Code Execution
10047
Remote Code Execution
10048
Remote Code Execution
10481
Remote Code Execution
10482
Remote Code Execution
10484
Remote Code Execution
9312
Remote Code Execution
10287
Remote Code Execution
9311
Remote Code Execution
9318
Remote Code Execution
9344
Remote Code Execution
10050
Remote Code Execution
10051
Remote Code Execution
10049
Remote Code Execution
10378
Remote Code Execution
10379
Remote Code Execution
10483
Remote Code Execution
10543
Remote Code Execution
10816
Remote Code Execution
10855
Critical
10729
Critical
10735
Critical
10789
Critical
10788
Critical
10852
Critical
10853
Critical
10951
Critical
10952
Critical
10047
Critical
10048
Critical
10481
Critical
10482
Critical
10484
Critical
9312
Critical
10287
Critical
9311
Critical
9318
Critical
9344
Critical
10050
Critical
10051
Critical
10049
Critical
10378
Critical
10379
Critical
10483
Critical
10543
Critical
10816
Critical
10855
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10729
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10735
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10789
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10788
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10852
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10853
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10951
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10952
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10047
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10048
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10481
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10482
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10484
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9312
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10287
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9311
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9318
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9344
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10050
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10051
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10049
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10378
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10379
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10483
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10543
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10816
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10855
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9312
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
10287
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9311
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9318
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
<p><strong>Disable SMBv1</strong></p>
<p><strong>For customers running Windows Vista and later</strong>
<a href="https://support.microsoft.com/kb/2696547">See Microsoft Knowledge Base Article 2696547</a>.</p>
<p><strong>Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later</strong>
For client operating systems:</p>
<ol>
<li>Open <strong>Control Panel</strong>, click <strong>Programs</strong>, and then click <strong>Turn Windows features on or off</strong>.</li>
<li>In the <strong>Windows Features</strong> window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> checkbox, and then click <strong>OK</strong> to close the window.</li>
<li>Restart the system.</li>
</ol>
<p>For server operating systems:</p>
<ol>
<li>Open <strong>Server Manager</strong> and then click the <strong>Manage</strong> menu and select <strong>Remove Roles and Features</strong>.</li>
<li>In the Features window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> check box, and then click OK to close the window.</li>
<li>Restart the system.</li>
</ol>
<p><strong>Impact of workaround.</strong>
The SMBv1 protocol will be disabled on the target system.</p>
<p><strong>How to undo the workaround</strong>.
Retrace the workaround steps, and select the <strong>SMB1.0/CIFS File Sharing Support</strong> check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.</p>
Viktor Brange of WDG Offensive Security Research Team
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows SMB Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 1.0 (SMBv1) server handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server.</p>
<p>To exploit the vulnerability, in most situations, an authenticated attacker could send a specially crafted packet to a targeted SMBv1 server.</p>
<p>The security update addresses the vulnerability by correcting how SMBv1 handles these specially crafted requests.</p>
Windows SMB Server
CVE-2017-0279
10729
10735
10789
10788
10852
10853
10951
10952
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
Remote Code Execution
10729
Remote Code Execution
10735
Remote Code Execution
10789
Remote Code Execution
10788
Remote Code Execution
10852
Remote Code Execution
10853
Remote Code Execution
10951
Remote Code Execution
10952
Remote Code Execution
10047
Remote Code Execution
10048
Remote Code Execution
10481
Remote Code Execution
10482
Remote Code Execution
10484
Remote Code Execution
9312
Remote Code Execution
10287
Remote Code Execution
9311
Remote Code Execution
9318
Remote Code Execution
9344
Remote Code Execution
10050
Remote Code Execution
10051
Remote Code Execution
10049
Remote Code Execution
10378
Remote Code Execution
10379
Remote Code Execution
10483
Remote Code Execution
10543
Remote Code Execution
10816
Remote Code Execution
10855
Critical
10729
Critical
10735
Critical
10789
Critical
10788
Critical
10852
Critical
10853
Critical
10951
Critical
10952
Critical
10047
Critical
10048
Critical
10481
Critical
10482
Critical
10484
Critical
9312
Critical
10287
Critical
9311
Critical
9318
Critical
9344
Critical
10050
Critical
10051
Critical
10049
Critical
10378
Critical
10379
Critical
10483
Critical
10543
Critical
10816
Critical
10855
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10729
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10735
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10789
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10788
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10852
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10853
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10951
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10952
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10047
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10048
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10481
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10482
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10484
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9312
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10287
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9311
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9318
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9344
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10050
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10051
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10049
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10378
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10379
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10483
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10543
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10816
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10855
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9312
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
10287
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9311
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9318
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
<p><strong>Disable SMBv1</strong></p>
<p><strong>For customers running Windows Vista and later</strong>
<a href="https://support.microsoft.com/kb/2696547">See Microsoft Knowledge Base Article 2696547</a>.</p>
<p><strong>Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later</strong>
For client operating systems:</p>
<ol>
<li>Open <strong>Control Panel</strong>, click <strong>Programs</strong>, and then click <strong>Turn Windows features on or off</strong>.</li>
<li>In the <strong>Windows Features</strong> window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> checkbox, and then click <strong>OK</strong> to close the window.</li>
<li>Restart the system.</li>
</ol>
<p>For server operating systems:</p>
<ol>
<li>Open <strong>Server Manager</strong> and then click the <strong>Manage</strong> menu and select <strong>Remove Roles and Features</strong>.</li>
<li>In the Features window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> check box, and then click OK to close the window.</li>
<li>Restart the system.</li>
</ol>
<p><strong>Impact of workaround.</strong>
The SMBv1 protocol will be disabled on the target system.</p>
<p><strong>How to undo the workaround</strong>.
Retrace the workaround steps, and select the <strong>SMB1.0/CIFS File Sharing Support</strong> check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.</p>
Swamy Shivaganga Nagaraju of MSRC Vulnerabilities & Mitigations
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Windows SMB Denial of Service Vulnerability
<p>A denial of service vulnerability exists in the Microsoft Server Block Message (SMB) when an attacker sends specially crafted requests to the server. An attacker who exploited this vulnerability could cause the affected system to stop responding until it is manually restarted. To attempt to exploit this issue, an attacker would need to send specially crafted SMB requests to the target system.</p>
<p>Note that the denial of service vulnerability would not allow an attacker to execute code or to elevate their user rights, but it could cause the affected system to stop accepting requests.</p>
<p>The security update addresses the vulnerability by correcting the manner in which SMB handles specially crafted client requests.</p>
Windows SMB Server
CVE-2017-0280
10729
10735
10789
10788
10852
10853
10951
10952
10047
10048
10481
10482
10484
9312
10287
9311
9318
9344
10050
10051
10049
10378
10379
10483
10543
10816
10855
Denial of Service
10729
Denial of Service
10735
Denial of Service
10789
Denial of Service
10788
Denial of Service
10852
Denial of Service
10853
Denial of Service
10951
Denial of Service
10952
Denial of Service
10047
Denial of Service
10048
Denial of Service
10481
Denial of Service
10482
Denial of Service
10484
Denial of Service
9312
Denial of Service
10287
Denial of Service
9311
Denial of Service
9318
Denial of Service
9344
Denial of Service
10050
Denial of Service
10051
Denial of Service
10049
Denial of Service
10378
Denial of Service
10379
Denial of Service
10483
Denial of Service
10543
Denial of Service
10816
Denial of Service
10855
Important
10729
Important
10735
Important
10789
Important
10788
Important
10852
Important
10853
Important
10951
Important
10952
Important
10047
Important
10048
Important
10481
Important
10482
Important
10484
Important
9312
Important
10287
Important
9311
Important
9318
Important
9344
Important
10050
Important
10051
Important
10049
Important
10378
Important
10379
Important
10483
Important
10543
Important
10816
Important
10855
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10729
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10735
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10789
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10788
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10852
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10853
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10951
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10952
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10047
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10048
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10481
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10482
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10484
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9312
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10287
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9311
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9318
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
9344
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10050
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10051
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10049
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10378
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10379
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10483
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10543
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10816
7.0
6.3
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:P/RL:O/RC:C
10855
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10729
Yes
Security Update
4019474
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019474
4015221
10735
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10789
Yes
Security Update
4019473
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019473
4015219
10788
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10852
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10853
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10951
Yes
Security Update
4016871
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4016871
4015583
10952
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10047
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10047
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10048
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10048
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10481
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10481
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10482
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10482
Yes
Security Only
4019215
4015550
10484
Yes
Monthly Rollup
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9312
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
10287
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9311
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9318
Yes
Security Update
4018466
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4018466
4012598
9344
Yes
Security Update
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10050
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10050
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10051
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10051
Yes
Security Only
4019264
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019264
4015549
10049
Yes
Monthly Rollup
4019263
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019263
10049
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10378
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10378
Yes
Security Only
4019216
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019216
4015551
10379
Yes
Monthly Rollup
4019214
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019214
10379
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10483
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10483
Yes
Security Only
4019215
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019215
4015550
10543
Yes
Monthly Rollup
4019213
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019213
10543
Yes
Security Only
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10816
Yes
Security Update
4019472
https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4019472
4015217
10855
Yes
Security Update
<p><strong>Disable SMBv1</strong></p>
<p><strong>For customers running Windows Vista and later</strong>
<a href="https://support.microsoft.com/kb/2696547">See Microsoft Knowledge Base Article 2696547</a>.</p>
<p><strong>Alternative method for customers running Windows 8.1 or Windows Server 2012 R2 and later</strong>
For client operating systems:</p>
<ol>
<li>Open <strong>Control Panel</strong>, click <strong>Programs</strong>, and then click <strong>Turn Windows features on or off</strong>.</li>
<li>In the <strong>Windows Features</strong> window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> checkbox, and then click <strong>OK</strong> to close the window.</li>
<li>Restart the system.</li>
</ol>
<p>For server operating systems:</p>
<ol>
<li>Open <strong>Server Manager</strong> and then click the <strong>Manage</strong> menu and select <strong>Remove Roles and Features</strong>.</li>
<li>In the Features window, clear the <strong>SMB1.0/CIFS File Sharing Support</strong> check box, and then click OK to close the window.</li>
<li>Restart the system.</li>
</ol>
<p><strong>Impact of workaround.</strong>
The SMBv1 protocol will be disabled on the target system.</p>
<p><strong>How to undo the workaround</strong>.
Retrace the workaround steps, and select the <strong>SMB1.0/CIFS File Sharing Support</strong> check box to restore the SMB1.0/CIFS File Sharing Support feature to an active state.</p>
MSRC Vulnerabilities & Mitigations and WDG Offensive Security Research Team
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
2.0
2017-05-11T07:00:00Z
<p>The package KB numbers for Windows Server 2012 and Windows Server 2012 (Server Core installation) were transposed in the Security Update Guide for the May 2017 Security Updates Release. These package KB entries have been corrected in the Affected Products table to reflect the proper values of Monthly Rollup (4019214) and Security Only (4019216). Microsoft recommends that customers who have downloaded updates for Windows Server 2012 and Windows Server 2012 (Server Core installation) verify that they have downloaded the correct package for their environment.</p>
Microsoft Office Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user.</p>
<p>To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.</p>
<p>The security update addresses the vulnerability by correcting how Microsoft Office handles files in memory.</p>
<p>The affected software table contains the link to the SharePoint Server 2013 cumulative update, KB 3191913, which includes all of the required SharePoint Server 2013 updates for CVE-2017-0281. As an alternative to installing the cumulative update, you may install the individual security updates from the following links. You must install all packages applicable to your environment to be protected from the vulnerability described in CVE-2017-0281.</p>
<p><a href="https://www.microsoft.com/downloads/details.aspx?familyid=b9969f43-8058-41f7-be6a-df74acbb71b5">3178633</a>
<a href="https://www.microsoft.com/downloads/details.aspx?familyid=5f6a6232-e7b4-48f1-b896-b1e6958079f0">3191886</a>
<a href="https://www.microsoft.com/downloads/details.aspx?familyid=a0547493-4a93-4d33-ada8-1bbfd514f547">3172532</a>
<a href="https://www.microsoft.com/downloads/details.aspx?familyid=86bb3eb4-a432-4672-95e7-a27a07c50988">3172536</a>
<a href="https://www.microsoft.com/downloads/details.aspx?familyid=fd07c1eb-9413-43df-843f-ad9c045494ba">3162068</a>
<a href="https://www.microsoft.com/downloads/details.aspx?familyid=59095cf6-28f6-4164-a2f5-9f906bec4648">3172475</a>
<a href="https://www.microsoft.com/downloads/details.aspx?familyid=a42900c5-0f9a-4b20-9011-8a82693b81fd">3162069</a>
<a href="https://www.microsoft.com/downloads/details.aspx?familyid=3c1ae42f-8802-4ce0-84ee-f700b6e2b72d">3162054</a>
<a href="https://www.microsoft.com/downloads/details.aspx?familyid=d48c21b6-1489-4144-b70e-c1bc4d18bf31">3178638</a>
<a href="https://www.microsoft.com/downloads/details.aspx?familyid=93d81f31-7b84-4305-b5db-bf7fa00b77fa">3172482</a>
<a href="https://www.microsoft.com/downloads/details.aspx?familyid=52d2b6e0-4525-4c0e-a0eb-316592099000">3191887</a></p>
Microsoft Office
CVE-2017-0281
10753
10754
10748
10150
10521
10522
10601
10602
10525
10608
10614
999017
10495
10770
10771
11099
10746
10747
Remote Code Execution
10753
Remote Code Execution
10754
Remote Code Execution
10748
Remote Code Execution
10150
Remote Code Execution
10521
Remote Code Execution
10522
Remote Code Execution
10601
Remote Code Execution
10602
Remote Code Execution
10525
Remote Code Execution
10608
Remote Code Execution
10614
Remote Code Execution
999017
Remote Code Execution
10495
Remote Code Execution
10770
Remote Code Execution
10771
Remote Code Execution
11099
Remote Code Execution
10746
Remote Code Execution
10747
Important
10753
Important
10754
Important
10748
Important
10150
Important
10521
Important
10522
Important
10601
Important
10602
Important
10525
Important
10608
Important
10614
Important
999017
Important
10495
Important
10770
Important
10771
Important
11099
Important
10746
Important
10747
Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
3191863
https://www.microsoft.com/downloads/details.aspx?familyid=9b452988-9638-4fa0-b03c-0edd26109873
10753
Maybe
Security Update
3191881
https://www.microsoft.com/downloads/details.aspx?familyid=c2ed2220-6cd3-4fed-8b19-7f83c19e54f2
10753
Maybe
Security Update
3191863
https://www.microsoft.com/downloads/details.aspx?familyid=040c3b4f-4eda-4a75-b666-f3ed39fd6d22
10754
Maybe
Security Update
3191881
https://www.microsoft.com/downloads/details.aspx?familyid=58bf6e6d-e0ae-459e-bd68-c56f8fb5d541
10754
Maybe
Security Update
3191915
https://www.microsoft.com/downloads/details.aspx?familyid=edd84be9-adf3-4c2e-bc31-b7b1dfe4f27d
3127895
10748
Maybe
Security Update
2596904
https://www.microsoft.com/downloads/details.aspx?familyid=b1968c98-7b9e-4219-b112-a0bc87a41d6e
10150
Maybe
Security Update
3191895
https://www.microsoft.com/downloads/details.aspx?familyid=2d550aa4-8e46-41e1-97e2-2e9df0f48552
10150
Maybe
Security Update
3191899
https://www.microsoft.com/downloads/details.aspx?familyid=006e7930-4f78-4d4f-be31-69d8389b057a
10521
Maybe
Security Update
3191899
https://www.microsoft.com/downloads/details.aspx?familyid=4cfab5be-c95d-43ae-81e6-bdd620f21a8a
10522
Maybe
Security Update
3191885
https://www.microsoft.com/downloads/details.aspx?familyid=d5a06ff3-15f1-4c28-a6e8-396b3a625942
10601
Maybe
Security Update
3191885
https://www.microsoft.com/downloads/details.aspx?familyid=fa0b769f-ef89-4f65-be73-034842687996
10602
Maybe
Security Update
3191904
https://www.microsoft.com/downloads/details.aspx?familyid=c7a5462c-44e2-4c80-9ff4-cb19ca275ad5
10525
Maybe
Security Update
3191888
https://www.microsoft.com/downloads/details.aspx?familyid=ee3effcf-0906-4ae3-940e-c406813bcd24
10608
Maybe
Security Update
3191890
https://www.microsoft.com/downloads/details.aspx?familyid=158d0e79-078a-44b4-9c5b-cba17f530c39
10614
Maybe
Security Update
3191880
https://www.microsoft.com/downloads/details.aspx?familyid=4e8bcbb7-e93d-423f-8e39-c9d5d8cc88f5
999017
Maybe
Security Update
3191839
https://www.microsoft.com/downloads/details.aspx?familyid=19c3be5d-9a37-42fe-a9aa-c374f2f00728
3178684
10495
Maybe
Security Update
3191858
https://www.microsoft.com/downloads/details.aspx?familyid=d9017396-a617-4e07-bb81-4e551f78f85f
3178656
10770
Maybe
Security Update
3191858
https://www.microsoft.com/downloads/details.aspx?familyid=3bd89443-6310-4322-8068-797e63de293f
3178656
10771
Maybe
Security Update
3191913
https://www.microsoft.com/downloads/details.aspx?familyid=b31addba-63ad-4cff-8f74-bf7f9b414098
11099
Maybe
Security Update
3191865
https://www.microsoft.com/downloads/details.aspx?familyid=57718f1b-527f-4f7b-8163-b5b64b0ee70b
3178674
10746
Maybe
Security Update
3191865
https://www.microsoft.com/downloads/details.aspx?familyid=7ca94c93-746a-4e97-b6fd-e76b44d9e1c4
3178674
10747
Maybe
Security Update
1.0
2017-05-09T07:00:00Z
<p>Information published.</p>
1.1
2017-05-10T07:00:00Z
<p>Updated FAQ information. This is an informational change only.</p>