September 2017 Security Updates Security Update secure@microsoft.com The Microsoft Security Response Center (MSRC) identifies, monitors, resolves, and responds to security incidents and Microsoft software security vulnerabilities. For more information, see http://www.microsoft.com/security/msrc. 2017-Sep 2017-Sep Final 1.0 6 2026-02-19T01:35:56 September 2017 Security Updates 2017-09-12T07:00:00Z 2026-02-19T01:35:56 <p>The September security release consists of security updates for the following software:</p> <ul> <li>Internet Explorer</li> <li>Microsoft Edge</li> <li>Microsoft Windows</li> <li>Microsoft Office and Microsoft Office Services and Web Apps</li> <li>Adobe Flash Player</li> <li>Skype for Business and Lync</li> <li>.NET Framework</li> <li>Microsoft Exchange Server</li> </ul> <p>Please note the following information regarding the security updates:</p> <ul> <li>Windows 10 updates are cumulative. The monthly security release includes all security fixes for vulnerabilities that affect Windows 10, in addition to non-security updates. The updates are available via the <a href="http://catalog.update.microsoft.com/v7/site/Home.aspx">Microsoft Update Catalog</a>.</li> <li>Starting in March 2017, a delta package will be available on the Microsoft Update Catalog for Windows 10 version 1607 and newer. This delta package contains just the delta changes between the previous month and the current release.</li> <li>Updates for Windows RT 8.1 and Microsoft Office RT software are only available via <a href="http://go.microsoft.com/fwlink/?LinkId=21130">Windows Update</a>.</li> <li>In addition to security changes for the vulnerabilities, updates include defense-in-depth updates to help improve security-related features.</li> <li>For information on lifecycle and support dates for Windows 10 operating systems, please see <a href="https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet">Windows Lifecycle Facts Sheet</a>.</li> </ul> <p><strong>Known Issues</strong></p> <ul> <li><a href="https://support.microsoft.com/help/4011040">4011040</a></li> <li><a href="https://support.microsoft.com/help/4011050">4011050</a></li> <li><a href="https://support.microsoft.com/help/4011960">4040960</a></li> <li><a href="https://support.microsoft.com/help/4040971">4040971</a></li> <li><a href="https://support.microsoft.com/help/4040972">4040972</a></li> <li><a href="https://support.microsoft.com/help/4040973">4040973</a></li> <li><a href="https://support.microsoft.com/help/4040977">4040977</a></li> </ul> The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1703 for 32-bit Systems Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1703 for x64-based Systems Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems Microsoft Edge (EdgeHTML-based) on Windows 10 for x64-based Systems Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1511 for 32-bit Systems Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1511 for x64-based Systems Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for 32-bit Systems Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for x64-based Systems Microsoft Edge (EdgeHTML-based) on Windows Server 2016 Internet Explorer 11 on Windows 10 Version 1703 for 32-bit Systems Internet Explorer 11 on Windows 10 Version 1703 for x64-based Systems Internet Explorer 11 on Windows 10 for 32-bit Systems Internet Explorer 11 on Windows 10 for x64-based Systems Internet Explorer 11 on Windows 10 Version 1511 for 32-bit Systems Internet Explorer 11 on Windows 10 Version 1511 for x64-based Systems Internet Explorer 11 on Windows 10 Version 1607 for 32-bit Systems Internet Explorer 11 on Windows 10 Version 1607 for x64-based Systems Internet Explorer 11 on Windows Server 2016 Internet Explorer 11 on Windows 7 for 32-bit Systems Service Pack 1 Internet Explorer 11 on Windows 7 for x64-based Systems Service Pack 1 Internet Explorer 11 on Windows 8.1 for 32-bit systems Internet Explorer 11 on Windows 8.1 for x64-based systems Internet Explorer 11 on Windows RT 8.1 Internet Explorer 11 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 Internet Explorer 11 on Windows Server 2012 R2 Internet Explorer 10 on Windows Server 2012 ChakraCore Microsoft SharePoint Server 2013 Service Pack 1 Microsoft Office 2016 (32-bit edition) Microsoft Office 2016 (64-bit edition) Microsoft Excel Web App 2013 Service Pack 1 Microsoft Excel 2016 (32-bit edition) Microsoft Excel 2016 (64-bit edition) Microsoft Excel 2007 Service Pack 3 Microsoft Excel 2010 Service Pack 2 (32-bit editions) Microsoft Excel 2010 Service Pack 2 (64-bit editions) Microsoft Excel 2013 RT Service Pack 1 Microsoft Excel 2013 Service Pack 1 (32-bit editions) Microsoft Excel 2013 Service Pack 1 (64-bit editions) Microsoft Excel for Mac 2011 Microsoft Excel 2016 for Mac Microsoft Excel Viewer 2007 Service Pack 3 Microsoft Office Compatibility Pack Service Pack 3 Microsoft Office Web Apps 2013 Service Pack 1 Office Online Server Excel Services on Microsoft SharePoint Server 2010 Service Pack 2 Excel Services on Microsoft SharePoint Server 2007 Service Pack 3 (32-bit editions) Excel Services on Microsoft SharePoint Server 2007 Service Pack 3 (64-bit editions) Microsoft Office 2016 for Mac Microsoft Office 2007 Service Pack 3 Microsoft Office 2010 Service Pack 2 (32-bit editions) Microsoft Office 2010 Service Pack 2 (64-bit editions) Microsoft Office for Mac 2011 Microsoft Office Word Viewer Microsoft Live Meeting 2007 Add-in Skype for Business 2016 (32-bit) Skype for Business 2016 (64-bit) Skype for Business 2016 Basic (32-bit) Skype for Business 2016 Basic (64-bit) Microsoft Live Meeting 2007 Console Microsoft Lync 2010 (32-bit) Microsoft Lync 2010 (64-bit) Microsoft Lync 2010 Attendee (admin level install) Microsoft Lync 2010 Attendee (user level install) Microsoft Lync 2013 Service Pack 1 (32-bit) Microsoft Lync 2013 Service Pack 1 (64-bit) Microsoft Lync Basic 2013 Service Pack 1 (32-bit) Microsoft Lync Basic 2013 Service Pack 1 (64-bit) Microsoft Office 2013 RT Service Pack 1 Microsoft Office 2013 Service Pack 1 (32-bit editions) Microsoft Office 2013 Service Pack 1 (64-bit editions) Microsoft SharePoint Foundation 2013 Service Pack 1 Microsoft Outlook 2016 (32-bit edition) Microsoft Outlook 2016 (64-bit edition) Microsoft Outlook 2007 Service Pack 3 Microsoft Outlook 2010 Service Pack 2 (32-bit editions) Microsoft Outlook 2010 Service Pack 2 (64-bit editions) Microsoft Outlook 2013 (32-bit editions) Microsoft Outlook 2013 (64-bit editions) Microsoft Outlook 2013 RT Service Pack 1 Microsoft Office Web Apps 2010 Service Pack 2 Microsoft Office Web Apps Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016 Microsoft PowerPoint 2013 Service Pack 1 (32-bit editions) Microsoft PowerPoint 2013 Service Pack 1 (64-bit editions) Microsoft PowerPoint 2013 RT Service Pack 1 Microsoft PowerPoint 2016 (32-bit edition) Microsoft PowerPoint 2016 (64-bit edition) Microsoft PowerPoint 2007 Service Pack 3 Microsoft PowerPoint 2010 Service Pack 2 (32-bit editions) Microsoft PowerPoint 2010 Service Pack 2 (64-bit editions) PowerPoint Viewer 2010 32-bit edition Microsoft Publisher 2007 Service Pack 3 Microsoft Publisher 2010 Service Pack 2 (32-bit editions) Microsoft Publisher 2010 Service Pack 2 (64-bit editions) Windows 10 Version 1703 for 32-bit Systems Windows 10 Version 1703 for x64-based Systems Windows 10 for 32-bit Systems Windows 10 for x64-based Systems Windows 10 Version 1511 for 32-bit Systems Windows 10 Version 1511 for x64-based Systems Windows 10 Version 1607 for 32-bit Systems Windows 10 Version 1607 for x64-based Systems Windows Server 2016 Windows Server 2016 (Server Core installation) Windows 8.1 for 32-bit systems Windows 8.1 for x64-based systems Windows RT 8.1 Windows Server 2012 Windows Server 2012 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 R2 (Server Core installation) Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for x64-based Systems Service Pack 1 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Windows Server 2008 for Itanium-Based Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Internet Explorer 9 on Windows Server 2008 for 32-bit Systems Service Pack 2 Internet Explorer 9 on Windows Server 2008 for x64-based Systems Service Pack 2 Adobe Flash Player on Windows 10 Version 1703 for 32-bit Systems Adobe Flash Player on Windows 10 Version 1703 for x64-based Systems Adobe Flash Player on Windows 10 for 32-bit Systems Adobe Flash Player on Windows 10 for x64-based Systems Adobe Flash Player on Windows 10 Version 1511 for 32-bit Systems Adobe Flash Player on Windows 10 Version 1511 for x64-based Systems Adobe Flash Player on Windows 10 Version 1607 for 32-bit Systems Adobe Flash Player on Windows 10 Version 1607 for x64-based Systems Adobe Flash Player on Windows Server 2016 Adobe Flash Player on Windows 8.1 for 32-bit systems Adobe Flash Player on Windows 8.1 for x64-based systems Adobe Flash Player on Windows RT 8.1 Adobe Flash Player on Windows Server 2012 Adobe Flash Player on Windows Server 2012 R2 Microsoft Exchange Server 2016 Cumulative Update 6 Microsoft Exchange Server 2013 Cumulative Update 17 Microsoft Exchange Server 2013 Cumulative Update 18 Microsoft Exchange Server 2016 Cumulative Update 7 Microsoft .NET Framework 4.6.2/4.7 on Windows 10 Version 1607 for 32-bit Systems Microsoft .NET Framework 4.6.2/4.7 on Windows 10 Version 1607 for x64-based Systems Microsoft .NET Framework 4.6.2/4.7 on Windows Server 2016 Microsoft .NET Framework 4.6.2/4.7 on Windows Server 2016 (Server Core installation) Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows 7 for 32-bit Systems Service Pack 1 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows 7 for x64-based Systems Service Pack 1 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows 8.1 for 32-bit systems Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows 8.1 for x64-based systems Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows RT 8.1 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows Server 2012 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows Server 2012 (Server Core installation) Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows Server 2012 R2 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows Server 2012 R2 (Server Core installation) Microsoft .NET Framework 4.7 on Windows 10 Version 1703 for 32-bit Systems Microsoft .NET Framework 4.7 on Windows 10 Version 1703 for x64-based Systems Microsoft .NET Framework 4.6 on Windows 10 for 32-bit Systems Microsoft .NET Framework 4.6 on Windows 10 for x64-based Systems Microsoft .NET Framework 4.6 on Windows Server 2008 for 32-bit Systems Service Pack 2 Microsoft .NET Framework 4.6 on Windows Server 2008 for x64-based Systems Service Pack 2 Microsoft .NET Framework 4.6.1 on Windows 10 Version 1511 for 32-bit Systems Microsoft .NET Framework 4.6.1 on Windows 10 Version 1511 for x64-based Systems Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2 Microsoft .NET Framework 3.5 on Windows 10 Version 1703 for 32-bit Systems Microsoft .NET Framework 3.5 on Windows 10 Version 1703 for x64-based Systems Microsoft .NET Framework 3.5 on Windows 10 for 32-bit Systems Microsoft .NET Framework 3.5 on Windows 10 for x64-based Systems Microsoft .NET Framework 3.5 on Windows 10 Version 1511 for 32-bit Systems Microsoft .NET Framework 3.5 on Windows 10 Version 1511 for x64-based Systems Microsoft .NET Framework 3.5 on Windows 10 Version 1607 for 32-bit Systems Microsoft .NET Framework 3.5 on Windows 10 Version 1607 for x64-based Systems Microsoft .NET Framework 3.5 on Windows Server 2016 Microsoft .NET Framework 3.5 on Windows Server 2016 (Server Core installation) Microsoft .NET Framework 3.5 on Windows 8.1 for 32-bit systems Microsoft .NET Framework 3.5 on Windows 8.1 for x64-based systems Microsoft .NET Framework 3.5 on Windows Server 2012 Microsoft .NET Framework 3.5 on Windows Server 2012 (Server Core installation) Microsoft .NET Framework 3.5 on Windows Server 2012 R2 Microsoft .NET Framework 3.5.1 on Windows 7 for 32-bit Systems Service Pack 1 Microsoft .NET Framework 3.5.1 on Windows 7 for x64-based Systems Service Pack 1 Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1 Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Microsoft .NET Framework 4.5.2 on Windows 7 for 32-bit Systems Service Pack 1 Microsoft .NET Framework 4.5.2 on Windows 7 for x64-based Systems Service Pack 1 Microsoft .NET Framework 4.5.2 on Windows 8.1 for 32-bit systems Microsoft .NET Framework 4.5.2 on Windows 8.1 for x64-based systems Microsoft .NET Framework 4.5.2 on Windows RT 8.1 Microsoft .NET Framework 4.5.2 on Windows Server 2008 for 32-bit Systems Service Pack 2 Microsoft .NET Framework 4.5.2 on Windows Server 2008 for x64-based Systems Service Pack 2 Microsoft .NET Framework 4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 Microsoft .NET Framework 4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Microsoft .NET Framework 4.5.2 on Windows Server 2012 Microsoft .NET Framework 4.5.2 on Windows Server 2012 (Server Core installation) Microsoft .NET Framework 4.5.2 on Windows Server 2012 R2 Microsoft .NET Framework 4.5.2 on Windows Server 2012 R2 (Server Core installation) Microsoft Office for Mac 2011 Microsoft Excel for Mac 2011 Windows 7 for 32-bit Systems Service Pack 1 Windows 7 for x64-based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1 Windows Server 2008 R2 for x64-based Systems Service Pack 1 Microsoft Lync 2010 (32-bit) Microsoft Office 2007 Service Pack 3 Microsoft Excel 2007 Service Pack 3 Microsoft Outlook 2007 Service Pack 3 Microsoft PowerPoint 2007 Service Pack 3 Microsoft Publisher 2007 Service Pack 3 Microsoft Lync 2010 Attendee (admin level install) Microsoft Excel Viewer 2007 Service Pack 3 Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) Microsoft Live Meeting 2007 Console Microsoft Lync 2010 Attendee (user level install) Microsoft Lync 2010 (64-bit) Microsoft Outlook 2013 (32-bit editions) Microsoft Outlook 2013 (64-bit editions) Internet Explorer 9 on Windows Server 2008 for 32-bit Systems Service Pack 2 Internet Explorer 9 on Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2012 Windows Server 2012 (Server Core installation) Adobe Flash Player on Windows Server 2012 Adobe Flash Player on Windows 8.1 for 32-bit systems Adobe Flash Player on Windows 8.1 for x64-based systems Adobe Flash Player on Windows Server 2012 R2 Adobe Flash Player on Windows RT 8.1 Adobe Flash Player on Windows 10 for 32-bit Systems Adobe Flash Player on Windows 10 for x64-based Systems Adobe Flash Player on Windows 10 Version 1511 for x64-based Systems Adobe Flash Player on Windows 10 Version 1511 for 32-bit Systems Adobe Flash Player on Windows Server 2016 Adobe Flash Player on Windows 10 Version 1607 for 32-bit Systems Adobe Flash Player on Windows 10 Version 1607 for x64-based Systems Adobe Flash Player on Windows 10 Version 1703 for 32-bit Systems Adobe Flash Player on Windows 10 Version 1703 for x64-based Systems Microsoft Outlook 2013 RT Service Pack 1 Windows 8.1 for 32-bit systems Windows 8.1 for x64-based systems Windows Server 2012 R2 Windows RT 8.1 Internet Explorer 11 on Windows 7 for 32-bit Systems Service Pack 1 Internet Explorer 11 on Windows 7 for x64-based Systems Service Pack 1 Internet Explorer 11 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 Internet Explorer 11 on Windows 8.1 for 32-bit systems Internet Explorer 11 on Windows 8.1 for x64-based systems Internet Explorer 11 on Windows Server 2012 R2 Internet Explorer 11 on Windows RT 8.1 Internet Explorer 11 on Windows 10 for 32-bit Systems Internet Explorer 11 on Windows 10 for x64-based Systems Internet Explorer 11 on Windows 10 Version 1511 for x64-based Systems Internet Explorer 11 on Windows 10 Version 1511 for 32-bit Systems Internet Explorer 11 on Windows Server 2016 Internet Explorer 11 on Windows 10 Version 1607 for 32-bit Systems Internet Explorer 11 on Windows 10 Version 1607 for x64-based Systems Internet Explorer 11 on Windows 10 Version 1703 for 32-bit Systems Internet Explorer 11 on Windows 10 Version 1703 for x64-based Systems Microsoft Excel 2010 Service Pack 2 (32-bit editions) Microsoft Excel 2010 Service Pack 2 (64-bit editions) Microsoft PowerPoint 2010 Service Pack 2 (32-bit editions) Microsoft PowerPoint 2010 Service Pack 2 (64-bit editions) Microsoft Publisher 2010 Service Pack 2 (32-bit editions) Microsoft Publisher 2010 Service Pack 2 (64-bit editions) Microsoft Office 2010 Service Pack 2 (32-bit editions) Microsoft Office 2010 Service Pack 2 (64-bit editions) Microsoft Office Web Apps 2010 Service Pack 2 Microsoft Outlook 2010 Service Pack 2 (32-bit editions) Microsoft Outlook 2010 Service Pack 2 (64-bit editions) Windows Server 2012 R2 (Server Core installation) Internet Explorer 10 on Windows Server 2012 Microsoft Office 2013 Service Pack 1 (32-bit editions) Microsoft Office 2013 Service Pack 1 (64-bit editions) Microsoft Office 2013 RT Service Pack 1 Microsoft SharePoint Server 2013 Service Pack 1 Microsoft Office Web Apps 2013 Service Pack 1 Microsoft Office Web Apps Server 2013 Service Pack 1 Microsoft SharePoint Foundation 2013 Service Pack 1 Microsoft Lync 2013 Service Pack 1 (32-bit) Microsoft Lync Basic 2013 Service Pack 1 (32-bit) Microsoft Lync 2013 Service Pack 1 (64-bit) Microsoft Lync Basic 2013 Service Pack 1 (64-bit) Microsoft .NET Framework 4.5.2 on Windows 7 for 32-bit Systems Service Pack 1 Microsoft .NET Framework 4.5.2 on Windows 7 for x64-based Systems Service Pack 1 Microsoft .NET Framework 4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Microsoft .NET Framework 4.5.2 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 Microsoft .NET Framework 4.5.2 on Windows Server 2012 Microsoft .NET Framework 4.5.2 on Windows Server 2012 (Server Core installation) Microsoft .NET Framework 4.5.2 on Windows 8.1 for 32-bit systems Microsoft .NET Framework 4.5.2 on Windows 8.1 for x64-based systems Microsoft .NET Framework 4.5.2 on Windows Server 2012 R2 Microsoft .NET Framework 4.5.2 on Windows RT 8.1 Microsoft .NET Framework 4.5.2 on Windows Server 2012 R2 (Server Core installation) Microsoft .NET Framework 4.5.2 on Windows Server 2008 for 32-bit Systems Service Pack 2 Microsoft .NET Framework 4.5.2 on Windows Server 2008 for x64-based Systems Service Pack 2 Microsoft Excel 2013 Service Pack 1 (32-bit editions) Microsoft Excel 2013 Service Pack 1 (64-bit editions) Microsoft Excel 2013 RT Service Pack 1 Microsoft Excel 2016 for Mac Microsoft PowerPoint 2013 Service Pack 1 (32-bit editions) Microsoft PowerPoint 2013 Service Pack 1 (64-bit editions) Microsoft PowerPoint 2013 RT Service Pack 1 Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems Microsoft Edge (EdgeHTML-based) on Windows 10 for x64-based Systems Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1511 for x64-based Systems Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1511 for 32-bit Systems Microsoft Edge (EdgeHTML-based) on Windows Server 2016 Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for 32-bit Systems Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for x64-based Systems Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1703 for 32-bit Systems Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1703 for x64-based Systems Microsoft .NET Framework 4.6 on Windows 10 for 32-bit Systems Microsoft .NET Framework 4.6 on Windows 10 for x64-based Systems Microsoft .NET Framework 4.6 on Windows Server 2008 for 32-bit Systems Service Pack 2 Microsoft .NET Framework 4.6 on Windows Server 2008 for x64-based Systems Service Pack 2 Windows 10 for 32-bit Systems Microsoft Office 2016 for Mac Windows 10 for x64-based Systems Microsoft Excel 2016 (32-bit edition) Microsoft Excel 2016 (64-bit edition) Microsoft PowerPoint 2016 (32-bit edition) Microsoft PowerPoint 2016 (64-bit edition) Microsoft Office 2016 (32-bit edition) Microsoft Office 2016 (64-bit edition) Microsoft Outlook 2016 (32-bit edition) Microsoft Outlook 2016 (64-bit edition) Microsoft Excel Web App 2013 Service Pack 1 Skype for Business 2016 (32-bit) Skype for Business 2016 (64-bit) Skype for Business 2016 Basic (32-bit) Skype for Business 2016 Basic (64-bit) Windows 10 Version 1511 for x64-based Systems Windows 10 Version 1511 for 32-bit Systems Microsoft .NET Framework 4.6.1 on Windows 10 Version 1511 for x64-based Systems Microsoft .NET Framework 4.6.1 on Windows 10 Version 1511 for 32-bit Systems Windows Server 2016 Office Online Server Windows 10 Version 1607 for 32-bit Systems Windows 10 Version 1607 for x64-based Systems Windows Server 2016 (Server Core installation) Microsoft SharePoint Enterprise Server 2016 Windows 10 Version 1703 for 32-bit Systems Windows 10 Version 1703 for x64-based Systems Microsoft Live Meeting 2007 Add-in Microsoft .NET Framework 4.7 on Windows 10 Version 1703 for 32-bit Systems Microsoft .NET Framework 4.7 on Windows 10 Version 1703 for x64-based Systems Microsoft .NET Framework 4.6.2/4.7 on Windows Server 2016 Microsoft .NET Framework 4.6.2/4.7 on Windows 10 Version 1607 for 32-bit Systems Microsoft .NET Framework 4.6.2/4.7 on Windows 10 Version 1607 for x64-based Systems Microsoft .NET Framework 4.6.2/4.7 on Windows Server 2016 (Server Core installation) ChakraCore Microsoft Exchange Server 2013 Cumulative Update 17 Microsoft Exchange Server 2016 Cumulative Update 6 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows 7 for 32-bit Systems Service Pack 1 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows 7 for x64-based Systems Service Pack 1 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows Server 2012 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows Server 2012 (Server Core installation) Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows 8.1 for 32-bit systems Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows 8.1 for x64-based systems Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows Server 2012 R2 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows RT 8.1 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 on Windows Server 2012 R2 (Server Core installation) PowerPoint Viewer 2010 32-bit edition Microsoft Exchange Server 2016 Cumulative Update 7 Microsoft Exchange Server 2013 Cumulative Update 18 Microsoft Office Word Viewer cm1 qemu-kvm 4.2.0-13 on CBL Mariner 1.0 cm1 libsndfile 1.0.31-1 on CBL Mariner 1.0 azl3 vitess 19.0.4-2 on Azure Linux 3.0 azl3 vitess 19.0.4-2 on Azure Linux 3.0 azl3 git 2.45.2-1 on Azure Linux 3.0 azl3 git 2.45.2-1 on Azure Linux 3.0 azl3 vitess 19.0.4-7 on Azure Linux 3.0 azl3 git 2.42.0-2 on Azure Linux 3.0 Microsoft .NET Framework 3.5 on Windows Server 2012 Microsoft .NET Framework 3.5 on Windows Server 2012 (Server Core installation) Microsoft .NET Framework 3.5 on Windows 8.1 for 32-bit systems Microsoft .NET Framework 3.5 on Windows 8.1 for x64-based systems Microsoft .NET Framework 3.5 on Windows Server 2012 R2 Microsoft .NET Framework 3.5 on Windows 10 for 32-bit Systems Microsoft .NET Framework 3.5 on Windows 10 for x64-based Systems Microsoft .NET Framework 3.5 on Windows 10 Version 1511 for x64-based Systems Microsoft .NET Framework 3.5 on Windows 10 Version 1511 for 32-bit Systems Microsoft .NET Framework 3.5 on Windows Server 2016 Microsoft .NET Framework 3.5 on Windows 10 Version 1607 for 32-bit Systems Microsoft .NET Framework 3.5 on Windows 10 Version 1607 for x64-based Systems Microsoft .NET Framework 3.5 on Windows Server 2016 (Server Core installation) Microsoft .NET Framework 3.5 on Windows 10 Version 1703 for 32-bit Systems Microsoft .NET Framework 3.5 on Windows 10 Version 1703 for x64-based Systems Microsoft Office Compatibility Pack Service Pack 3 Excel Services on Microsoft SharePoint Server 2010 Service Pack 2 Excel Services on Microsoft SharePoint Server 2007 Service Pack 3 (64-bit editions) Excel Services on Microsoft SharePoint Server 2007 Service Pack 3 (32-bit editions) Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for Itanium-Based Systems Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for 32-bit Systems Service Pack 2 Microsoft .NET Framework 2.0 Service Pack 2 on Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for Itanium-Based Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) Microsoft .NET Framework 3.5.1 on Windows 7 for 32-bit Systems Service Pack 1 Microsoft .NET Framework 3.5.1 on Windows 7 for x64-based Systems Service Pack 1 Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1 Microsoft .NET Framework 3.5.1 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values which trigger an out-of-bounds write. <p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p> <p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p> Mariner mitre Yes CVE-2017-14167 Integer Overflow or Wraparound 16843-16820 16843-16820 Important 16843-16820 8.8 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 16843-16820 CBL-Mariner Releases 16843-16820 No Security Update 4.2.0-13 https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade 16843-16820 CBL-Mariner Releases 1.0 2020-09-25T00:00:00 <p>Information published.</p> An out of bounds read in the function d2alaw_array() in alaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure related to mishandling of the NAN and INFINITY floating-point values. <p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p> <p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p> Mariner mitre Yes CVE-2017-14245 Out-of-bounds Read 16897-16820 16897-16820 Important 16897-16820 8.1 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H 16897-16820 CBL-Mariner Releases 16897-16820 No Security Update 1.0.31-1 https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade 16897-16820 CBL-Mariner Releases 1.0 2021-01-28T00:00:00 <p>Information published.</p> An out of bounds read in the function d2ulaw_array() in ulaw.c of libsndfile 1.0.28 may lead to a remote DoS attack or information disclosure related to mishandling of the NAN and INFINITY floating-point values. <p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p> <p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p> Mariner mitre Yes CVE-2017-14246 Out-of-bounds Read 16897-16820 16897-16820 Important 16897-16820 8.1 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H 16897-16820 CBL-Mariner Releases 16897-16820 No Security Update 1.0.31-1 https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade 16897-16820 CBL-Mariner Releases 1.0 2021-01-28T00:00:00 <p>Information published.</p> Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support. <p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p> <p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p> Mariner mitre Yes CVE-2017-14867 Improper Neutralization of Special Elements used in an OS Command (&#39;OS Command Injection&#39;) 16899-17084 16899-16817 19689-17084 16899-17084 16899-16817 19689-17084 Important 16899-17084 Important 16899-16817 Important 19689-17084 8.8 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 16899-17084 8.8 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 16899-16817 8.8 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 19689-17084 CBL-Mariner Releases 16899-17084 16899-16817 19689-17084 No Security Update 2.45.2-1 https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade 16899-17084 16899-16817 19689-17084 CBL-Mariner Releases 1.0 2025-09-03T19:28:37 <p>Information published.</p> 1.1 2026-02-18T01:02:28 <p>Information published.</p> In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e. a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind. <p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p> <p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p> Mariner mitre Yes CVE-2017-14623 Improper Authentication 16898-17084 16898-16817 17547-17084 16898-17084 16898-16817 17547-17084 Important 16898-17084 Important 16898-16817 Important 17547-17084 8.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H 16898-17084 8.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H 16898-16817 8.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H 17547-17084 CBL-Mariner Releases 16898-17084 16898-16817 17547-17084 No Security Update 19.0.4-2 https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade 16898-17084 16898-16817 17547-17084 CBL-Mariner Releases 1.0 2024-09-11T00:00:00 <p>Information published.</p> 1.1 2026-02-19T01:35:56 <p>Information published.</p> In libsndfile 1.0.28 a divide-by-zero error exists in the function double64_init() in double64.c which may lead to DoS when playing a crafted audio file. <p><strong>Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?</strong></p> <p>One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See <a href="https://www.microsoft.com/en-us/msrc/blog/2025/10/toward-greater-transparency-machine-readable-vulnerability-exploitability-xchange-for-azure-linux">this blog</a> post for more information. If impact to additional products is identified, we will update the CVE to reflect this.</p> Mariner mitre Yes CVE-2017-14634 Divide By Zero 16897-16820 16897-16820 Moderate 16897-16820 6.5 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H 16897-16820 CBL-Mariner Releases 16897-16820 No Security Update 1.0.31-1 https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade 16897-16820 CBL-Mariner Releases 1.0 2021-01-28T00:00:00 <p>Information published.</p> Microsoft Edge based on Edge HTML Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit the vulnerability, in a web-based attack scenario, an attacker could host a website in an attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could trick a user into clicking a link that takes the user to the attacker's site.</p> <p>The update addresses the vulnerability by modifying how Microsoft Edge based on Edge HTML handles objects in memory.</p> Microsoft Edge CVE-2017-8597 10724-10951 10724-10952 Information Disclosure 10724-10951 Information Disclosure 10724-10952 Important 10724-10951 Important 10724-10952 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:N/A 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10951 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10952 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update Liu Long of <a href="http://www.360.com/">Qihoo 360Vulcan Team</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft SharePoint Elevation of Privilege Vulnerability <p>An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.</p> <p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p> <p>The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests.</p> Microsoft Office CVE-2017-8629 10607 Elevation of Privilege 10607 Important 10607 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation Unlikely;DOS:N/A 4011113 https://www.microsoft.com/downloads/details.aspx?familyid=4df75d92-55d6-45d9-ac16-7aa923a0bb44 3203387 10607 Maybe Security Update Jayson Grace <a href="http://www.sandia.gov">Sandia National Laboratories</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Office Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user.</p> <p>To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Office handles files in memory.</p> Microsoft Office CVE-2017-8630 10753 10754 Remote Code Execution 10753 Remote Code Execution 10754 Important 10753 Important 10754 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 3203474 https://www.microsoft.com/downloads/details.aspx?familyid=ac7f11ed-895c-41c5-90a9-08cb58ab47a3 10753 Maybe Security Update 3203474 https://www.microsoft.com/downloads/details.aspx?familyid=faba99a6-ed11-43a7-ba1b-b0126dd29ec7 10754 Maybe Security Update <a href="https://twitter.com/debasishm89"> Debasish Mandal </a> of <a href="https://www.mcafee.com/"> McAfee IPS Vulnerability Research </a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Office Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user.</p> <p>To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Office handles files in memory.</p> Microsoft Office CVE-2017-8631 10767 10739 10740 10152 10489 10490 10656 10654 10655 10027 10672 10279 4497 10608 10836 9171-10120 9171-10308 9171-10307 Remote Code Execution 10767 Remote Code Execution 10739 Remote Code Execution 10740 Remote Code Execution 10152 Remote Code Execution 10489 Remote Code Execution 10490 Remote Code Execution 10656 Remote Code Execution 10654 Remote Code Execution 10655 Remote Code Execution 10027 Remote Code Execution 10672 Remote Code Execution 10279 Remote Code Execution 4497 Remote Code Execution 10608 Remote Code Execution 10836 Remote Code Execution 9171-10120 Remote Code Execution 9171-10308 Remote Code Execution 9171-10307 Important 10767 Important 10739 Important 10740 Important 10152 Important 10489 Important 10490 Important 10656 Important 10654 Important 10655 Important 10027 Important 10672 Important 10279 Important 4497 Important 10608 Important 10836 Important 9171-10120 Important 9171-10308 Important 9171-10307 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 3213562 https://www.microsoft.com/downloads/details.aspx?familyid=2148c1a7-92ae-481b-9305-a9f2231ec46e 10767 Maybe Security Update 4011050 https://www.microsoft.com/downloads/details.aspx?familyid=27248e4e-86c1-41d6-a6cd-2eaedc199358 3203477 10739 Maybe Security Update 4011050 https://www.microsoft.com/downloads/details.aspx?familyid=6b1a3077-183a-4b80-85a5-e46d4906b744 3203477 10740 Maybe Security Update 4011062 https://www.microsoft.com/downloads/details.aspx?familyid=05e8e8d4-50a7-4114-b3e6-9d55f5186607 10152 Maybe Security Update 4011061 https://www.microsoft.com/downloads/details.aspx?familyid=76792e87-6d32-4992-b2bd-678a2b4592c6 3191907 10489 Maybe Security Update 4011061 https://www.microsoft.com/downloads/details.aspx?familyid=a674b41d-d3ba-4a58-bae8-611c53d6e0e0 3191907 10490 Maybe Security Update 4011108 3213537 10656 Maybe Security Update 4011108 file://officerel/releases/office15/signed/clientqfepatch/x-none/15.0.4963.1000_excel-security-exe_none_sh 10654 Security Update 4011108 file://officerel/releases/office15/signed/clientqfepatch/x-none/15.0.4963.1000_excel-security-exe_none_sh 10655 Maybe Security Update 3212225 https://go.microsoft.com/fwlink/?linkid=853610 10027 No Security Update Release Notes https://go.microsoft.com/fwlink/p/?linkid=831049 10672 No Security Update 4011065 https://www.microsoft.com/downloads/details.aspx?familyid=c21c496e-a170-404c-8883-21eca5857b74 10279 Maybe Security Update 4011064 https://www.microsoft.com/downloads/details.aspx?familyid=55416433-62a6-4360-986e-7edc0decb454 4497 Maybe Security Update 3213562 https://www.microsoft.com/downloads/details.aspx?familyid=2148c1a7-92ae-481b-9305-a9f2231ec46e 10608 Maybe Security Update 3213658 https://www.microsoft.com/downloads/details.aspx?familyid=8b961b52-24b9-4ced-99fa-b8e19d397c9e 10836 Maybe Security Update 4011056 https://www.microsoft.com/downloads/details.aspx?familyid=4d28ede0-0b70-41a6-a121-2c2f8bb3c0a5 3191902 9171-10120 Maybe Security Update 3191831 https://www.microsoft.com/downloads/details.aspx?familyid=002133f9-9adb-4853-aee5-f55f05e39569 3178678 9171-10308 Maybe Security Update 3191831 https://www.microsoft.com/downloads/details.aspx?familyid=d424fe9a-8f8b-4184-bda6-8a253c854fa4 3178678 9171-10307 Maybe Security Update Steven Seeley (mr_me) of Offensive Security working with <a href="http://www.zerodayinitiative.com/">Trend Micro's Zero Day Initiative</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Office Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user.</p> <p>To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Office handles files in memory.</p> Microsoft Office CVE-2017-8632 10739 10740 10489 10490 10656 10654 10655 10027 10672 4497 Remote Code Execution 10739 Remote Code Execution 10740 Remote Code Execution 10489 Remote Code Execution 10490 Remote Code Execution 10656 Remote Code Execution 10654 Remote Code Execution 10655 Remote Code Execution 10027 Remote Code Execution 10672 Remote Code Execution 4497 Important 10739 Important 10740 Important 10489 Important 10490 Important 10656 Important 10654 Important 10655 Important 10027 Important 10672 Important 4497 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 4011050 https://www.microsoft.com/downloads/details.aspx?familyid=27248e4e-86c1-41d6-a6cd-2eaedc199358 3203477 10739 Maybe Security Update 4011050 https://www.microsoft.com/downloads/details.aspx?familyid=6b1a3077-183a-4b80-85a5-e46d4906b744 3203477 10740 Maybe Security Update 4011061 https://www.microsoft.com/downloads/details.aspx?familyid=76792e87-6d32-4992-b2bd-678a2b4592c6 3191907 10489 Maybe Security Update 4011061 https://www.microsoft.com/downloads/details.aspx?familyid=a674b41d-d3ba-4a58-bae8-611c53d6e0e0 3191907 10490 Maybe Security Update 4011108 3213537 10656 Maybe Security Update 4011108 https://www.microsoft.com/downloads/details.aspx?familyid=71e18663-2cc6-4fdf-af66-e1a99e2b6c38 3213537 10654 Maybe Security Update 4011108 https://www.microsoft.com/downloads/details.aspx?familyid=a674b41d-d3ba-4a58-bae8-611c53d6e0e0 3213537 10655 Maybe Security Update 3212225 https://go.microsoft.com/fwlink/?linkid=853610 10027 No Security Update Release Notes https://go.microsoft.com/fwlink/p/?linkid=831049 10672 No Security Update 4011064 https://www.microsoft.com/downloads/details.aspx?familyid=55416433-62a6-4360-986e-7edc0decb454 4497 Maybe Security Update Jaanus Kääp <br><a href=""><i>Clarified Security</i></a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Win32k Elevation of Privilege Vulnerability <p>An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.</p> <p>The update addresses this vulnerability by correcting how the Windows kernel-mode driver handles objects in memory.</p> Windows Kernel-Mode Drivers CVE-2017-8675 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 Elevation of Privilege 10951 Elevation of Privilege 10952 Elevation of Privilege 10729 Elevation of Privilege 10735 Elevation of Privilege 10789 Elevation of Privilege 10788 Elevation of Privilege 10852 Elevation of Privilege 10853 Elevation of Privilege 10816 Elevation of Privilege 10855 Elevation of Privilege 10047 Elevation of Privilege 10048 Elevation of Privilege 10481 Elevation of Privilege 10482 Elevation of Privilege 10484 Elevation of Privilege 9312 Elevation of Privilege 10287 Elevation of Privilege 9311 Elevation of Privilege 9318 Elevation of Privilege 9344 Elevation of Privilege 10050 Elevation of Privilege 10051 Elevation of Privilege 10049 Elevation of Privilege 10378 Elevation of Privilege 10379 Elevation of Privilege 10483 Elevation of Privilege 10543 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely;DOS:N/A 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10951 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10952 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10729 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10735 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10789 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10788 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10852 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10853 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10816 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10855 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10047 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10048 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10481 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10482 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10484 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 9312 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10287 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 9311 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 9318 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 9344 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10050 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10051 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10049 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10378 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10379 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10483 7.0 6.3 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10543 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9312 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 10287 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9311 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9318 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only WenQunWang of <a href="http://www.tencent.com/">Tencent's Xuanwu LAB</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows GDI+ Information Disclosure Vulnerability <p>An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system. By itself, the information disclosure does not allow arbitrary code execution; however, it could allow arbitrary code to be run if the attacker uses it in combination with another vulnerability.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.</p> <p>Note that where the severity is indicated as Critical in the Affected Products table, the Preview Pane is an attack vector for this vulnerability.</p> <p>The security update addresses the vulnerability by correcting how GDI handles memory addresses.</p> <p><strong>I am being offered this update for software that is not specifically indicated as being affected in the Affected Software and Vulnerability Severity Ratings table. Why am I being offered this update?</strong></p> <p>When updates address vulnerable code that exists in a component that is shared between multiple Microsoft Office products or shared between multiple versions of the same Microsoft Office product, the update is considered to be applicable to all supported products and versions that contain the vulnerable component.</p> <p>For example, when an update applies to Microsoft Office 2007 products, only Microsoft Office 2007 may be specifically listed in the Affected Software table. However, the update could apply to Microsoft Word 2007, Microsoft Excel 2007, Microsoft Visio 2007, Microsoft Compatibility Pack, Microsoft Excel Viewer, or any other Microsoft Office 2007 product that is not specifically listed in the Affected Software table. Furthermore, when an update applies to Microsoft Office 2010 products, only Microsoft Office 2010 may be specifically listed in the Affected Software table. However, the update could apply to Microsoft Word 2010, Microsoft Excel 2010, Microsoft Visio 2010, Microsoft Visio Viewer, or any other Microsoft Office 2010 product that is not specifically listed in the Affected Software table.</p> <p>For more information on this behavior and recommended actions, see <a href="https://support.microsoft.com/kb/830335">Microsoft Knowledge Base Article 830335</a>. For a list of Microsoft Office products that an update may apply to, refer to the Microsoft Knowledge Base Article associated with the specific update.</p> Microsoft Graphics Component CVE-2017-8676 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 10734 10150 10521 10522 10024 1160 10956 10770 10771 10772 10773 10290 10069 10303 10268 10295 10628 10630 10629 10631 Information Disclosure 10951 Information Disclosure 10952 Information Disclosure 10729 Information Disclosure 10735 Information Disclosure 10789 Information Disclosure 10788 Information Disclosure 10852 Information Disclosure 10853 Information Disclosure 10816 Information Disclosure 10855 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 10481 Information Disclosure 10482 Information Disclosure 10484 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Information Disclosure 10734 Information Disclosure 10150 Information Disclosure 10521 Information Disclosure 10522 Information Disclosure 10024 Information Disclosure 1160 Information Disclosure 10956 Information Disclosure 10770 Information Disclosure 10771 Information Disclosure 10772 Information Disclosure 10773 Information Disclosure 10290 Information Disclosure 10069 Information Disclosure 10303 Information Disclosure 10268 Information Disclosure 10295 Information Disclosure 10628 Information Disclosure 10630 Information Disclosure 10629 Information Disclosure 10631 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Important 10734 Critical 10150 Critical 10521 Critical 10522 Important 10024 Critical 1160 Important 10956 Important 10770 Important 10771 Important 10772 Important 10773 Important 10290 Important 10069 Important 10303 Important 10268 Important 10295 Important 10628 Important 10630 Important 10629 Important 10631 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10951 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10952 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10729 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10735 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10789 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10788 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10852 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10853 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10816 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10855 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10047 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10048 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10481 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10482 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10484 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 9312 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10287 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 9311 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 9318 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 9344 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10050 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10051 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10049 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10378 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10379 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10483 3.3 3.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10543 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9312 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 10287 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9311 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9318 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only Release Notes https://go.microsoft.com/fwlink/p/?linkid=831049 10734 No Security Update 3213641 https://www.microsoft.com/downloads/details.aspx?familyid=1cb6ed3b-e7b0-48e0-8316-f65b173d44f9 10150 Maybe Security Update 3213638 https://www.microsoft.com/downloads/details.aspx?familyid=eed7d070-3dc7-4e28-883f-fc6019711a90 3191848 10521 Maybe Security Update 3213638 https://www.microsoft.com/downloads/details.aspx?familyid=8edba895-537d-4be9-908b-d8626d021961 3191848 10522 Maybe Security Update 3212225 https://go.microsoft.com/fwlink/?linkid=853610 10024 No Security Update 4011134 https://www.microsoft.com/downloads/details.aspx?familyid=08cec781-2b87-44e9-bbf7-ca0579015b66 3203484 1160 Maybe Security Update 4025869 http://support.microsoft.com/kb/4025869 4020736 10956 Security Update 4011040 https://www.microsoft.com/downloads/details.aspx?familyid=f9b16fc9-d311-4e89-b8ca-1c8885488b06 3203382 10770 Maybe Security Update 4011040 https://www.microsoft.com/downloads/details.aspx?familyid=71a1182f-d498-45ca-a827-6aa17147f22d 3203382 10771 Maybe Security Update 4011040 https://www.microsoft.com/downloads/details.aspx?familyid=f9b16fc9-d311-4e89-b8ca-1c8885488b06 3203382 10772 Maybe Security Update 4011040 https://www.microsoft.com/downloads/details.aspx?familyid=71a1182f-d498-45ca-a827-6aa17147f22d 3203382 10773 Maybe Security Update 4025868 http://support.microsoft.com/kb/4025868 4020735 10290 Maybe Security Update 4025865 https://www.microsoft.com/downloads/details.aspx?familyid=f145b833-309f-49c6-b664-4155a216150d 4020732 10069 Maybe Security Update 4025865 https://www.microsoft.com/downloads/details.aspx?familyid=31ce5e7d-19cf-4838-9c30-791f4cdff4ce 4020732 10303 Maybe Security Update 4025866 https://www.microsoft.com/downloads/details.aspx?familyid=8e4ef5f4-f86d-4a70-b315-53d5eb596e1c 4020733 10268 Maybe Security Update 4025867 https://www.microsoft.com/downloads/details.aspx?familyid=76de234f-ebf5-4294-b6e2-577d7dcf9e3d 4020734 10295 Maybe Security Update 4011107 https://www.microsoft.com/downloads/details.aspx?familyid=34d3be9d-8fe2-4bac-a0a9-86d790b748fe 3191939 10628 Maybe Security Update 4011107 https://www.microsoft.com/downloads/details.aspx?familyid=e2465f08-7003-4c31-b390-ee0ad19f4b78 3191939 10630 Maybe Security Update 4011107 https://www.microsoft.com/downloads/details.aspx?familyid=34d3be9d-8fe2-4bac-a0a9-86d790b748fe 3191939 10629 Maybe Security Update 4011107 https://www.microsoft.com/downloads/details.aspx?familyid=e2465f08-7003-4c31-b390-ee0ad19f4b78 3191939 10631 Maybe Security Update bear13oy of CloverSec Labs working with <a href="http://www.zerodayinitiative.com/">Trend Micro's Zero Day Initiative</a> Weibo Wang (<a href="https://twitter.com/ma1fan">@ma1fan</a>) of 360 SkyEye Labs 1.0 2017-09-12T07:00:00Z <p>Information published.</p> 1.1 2017-09-14T07:00:00Z <p>Added an FAQ to explain why security update 3191848 is not applicable to Office 2010 on Windows Server 2008 and later versions. This is an informational change only. Customers who have already installed the updates do not need to take any further action.</p> 1.2 2017-09-15T07:00:00Z <p>Corrected the Severity entries in the Affected Products table for Microsoft Office 2007 and Microsoft Office 2010 because the Preview Pane is an attack vector for these products. This is an informational change only. Customers who have already successfully installed the updates do not need to take any further action.</p> Windows GDI+ Information Disclosure Vulnerability <p>A information disclosure vulnerability exists when the Windows GDI+ component improperly discloses kernel memory addresses. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.</p> <p>The security update addresses the vulnerability by correcting how the Windows GDI+ component handles objects in memory.</p> Windows Kernel-Mode Drivers CVE-2017-8677 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10047 10048 10481 10482 10484 10050 10051 10049 10378 10379 10483 10543 Information Disclosure 10951 Information Disclosure 10952 Information Disclosure 10729 Information Disclosure 10735 Information Disclosure 10789 Information Disclosure 10788 Information Disclosure 10852 Information Disclosure 10853 Information Disclosure 10816 Information Disclosure 10855 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 10481 Information Disclosure 10482 Information Disclosure 10484 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10951 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10952 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10729 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10735 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10789 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10788 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10852 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10853 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10816 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10855 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10047 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10048 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10481 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10482 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10484 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10050 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10051 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10049 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10378 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10379 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10483 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10543 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only Mateusz Jurczyk, <a href="https://www.google.com/">Google Project Zero</a> <a href="https://twitter.com/TinySecEx">fanxiaocao</a> and <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, Qihoo 360 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Kernel Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.</p> <p>The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.</p> Windows Kernel-Mode Drivers CVE-2017-8678 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 Information Disclosure 10951 Information Disclosure 10952 Information Disclosure 10729 Information Disclosure 10735 Information Disclosure 10789 Information Disclosure 10788 Information Disclosure 10852 Information Disclosure 10853 Information Disclosure 10816 Information Disclosure 10855 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 10481 Information Disclosure 10482 Information Disclosure 10484 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10951 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10952 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10729 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10735 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10789 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10788 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10852 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10853 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10816 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10855 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10047 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10048 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10481 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10482 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10484 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9312 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10287 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9311 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9318 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9344 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10050 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10051 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10049 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10378 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10379 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10483 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10543 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9312 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 10287 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9311 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9318 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only Mateusz Jurczyk of <a href="https://www.google.com">Google Project Zero</a> <a href="https://twitter.com/TinySecEx">fanxiaocao</a> and <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, Qihoo 360 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Kernel Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.</p> <p>The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.</p> Windows Kernel CVE-2017-8679 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 Information Disclosure 10951 Information Disclosure 10952 Information Disclosure 10729 Information Disclosure 10735 Information Disclosure 10789 Information Disclosure 10788 Information Disclosure 10852 Information Disclosure 10853 Information Disclosure 10816 Information Disclosure 10855 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 10481 Information Disclosure 10482 Information Disclosure 10484 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10951 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10952 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10729 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10735 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10789 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10788 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10852 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10853 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10816 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10855 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10047 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10048 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10481 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10482 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10484 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9312 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10287 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9311 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9318 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9344 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10050 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10051 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10049 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10378 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10379 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10483 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10543 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 9312 Security Update 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 10287 Security Update 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 9311 Security Update 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 9318 Security Update 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only <a href="https://twitter.com/TinySecEx">fanxiaocao</a> and <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, Qihoo 360 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows GDI+ Information Disclosure Vulnerability <p>A information disclosure vulnerability exists when the Windows GDI+ component improperly discloses kernel memory addresses. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.</p> <p>The security update addresses the vulnerability by correcting how the Windows GDI+ component handles objects in memory.</p> Windows Kernel-Mode Drivers CVE-2017-8680 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 10481 Information Disclosure 10482 Information Disclosure 10484 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10047 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10048 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10481 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10482 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10484 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9312 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10287 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9311 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9318 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9344 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10050 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10051 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10049 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10378 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10379 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10483 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10543 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9312 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 10287 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9311 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9318 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only Mateusz Jurczyk of <a href="https://www.google.com">Google Project Zero</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows GDI+ Information Disclosure Vulnerability <p>A information disclosure vulnerability exists when the Windows GDI+ component improperly discloses kernel memory addresses. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.</p> <p>The security update addresses the vulnerability by correcting how the Windows GDI+ component handles objects in memory.</p> Windows Kernel-Mode Drivers CVE-2017-8681 10816 10855 10951 10952 10729 10735 10789 10788 10852 10853 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 Information Disclosure 10816 Information Disclosure 10855 Information Disclosure 10951 Information Disclosure 10952 Information Disclosure 10729 Information Disclosure 10735 Information Disclosure 10789 Information Disclosure 10788 Information Disclosure 10852 Information Disclosure 10853 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 10481 Information Disclosure 10482 Information Disclosure 10484 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Important 10816 Important 10855 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10816 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10855 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10951 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10952 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10729 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10735 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10789 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10788 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10852 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10853 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10047 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10048 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10481 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10482 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10484 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9312 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10287 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9311 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9318 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9344 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10050 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10051 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10049 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10483 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10543 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9312 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 10287 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9311 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9318 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only Mateusz Jurczyk of <a href="https://www.google.com">Google Project Zero</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Win32k Graphics Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>There are multiple ways an attacker could exploit this vulnerability.</p> <ul> <li><p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit this vulnerability and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email.</p> </li> <li><p>In a file sharing attack scenario, an attacker could provide a specially crafted document file that is designed to exploit this vulnerability, and then convince a user to open the document file.</p> </li> </ul> <p>The security update addresses the vulnerability by correcting how the Windows font library handles embedded fonts.</p> <p><strong>I am being offered this update for software that is not specifically indicated as being affected in the Affected Software and Vulnerability Severity Ratings table. Why am I being offered this update?</strong></p> <p>When updates address vulnerable code that exists in a component that is shared between multiple Microsoft Office products or shared between multiple versions of the same Microsoft Office product, the update is considered to be applicable to all supported products and versions that contain the vulnerable component.</p> <p>For example, when an update applies to Microsoft Office 2007 products, only Microsoft Office 2007 may be specifically listed in the Affected Software table. However, the update could apply to Microsoft Word 2007, Microsoft Excel 2007, Microsoft Visio 2007, Microsoft Compatibility Pack, Microsoft Excel Viewer, or any other Microsoft Office 2007 product that is not specifically listed in the Affected Software table. Furthermore, when an update applies to Microsoft Office 2010 products, only Microsoft Office 2010 may be specifically listed in the Affected Software table. However, the update could apply to Microsoft Word 2010, Microsoft Excel 2010, Microsoft Visio 2010, Microsoft Visio Viewer, or any other Microsoft Office 2010 product that is not specifically listed in the Affected Software table.</p> <p>For more information on this behavior and recommended actions, see <a href="https://support.microsoft.com/kb/830335">Microsoft Knowledge Base Article 830335</a>. For a list of Microsoft Office products that an update may apply to, refer to the Microsoft Knowledge Base Article associated with the specific update.</p> Microsoft Graphics Component CVE-2017-8682 10816 10855 10150 10521 10522 1160 10951 10952 10729 10735 10789 10788 10852 10853 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 Remote Code Execution 10816 Remote Code Execution 10855 Remote Code Execution 10150 Remote Code Execution 10521 Remote Code Execution 10522 Remote Code Execution 1160 Remote Code Execution 10951 Remote Code Execution 10952 Remote Code Execution 10729 Remote Code Execution 10735 Remote Code Execution 10789 Remote Code Execution 10788 Remote Code Execution 10852 Remote Code Execution 10853 Remote Code Execution 10047 Remote Code Execution 10048 Remote Code Execution 10481 Remote Code Execution 10482 Remote Code Execution 10484 Remote Code Execution 9312 Remote Code Execution 10287 Remote Code Execution 9311 Remote Code Execution 9318 Remote Code Execution 9344 Remote Code Execution 10050 Remote Code Execution 10051 Remote Code Execution 10049 Remote Code Execution 10378 Remote Code Execution 10379 Remote Code Execution 10483 Remote Code Execution 10543 Critical 10816 Critical 10855 Critical 10150 Critical 10521 Critical 10522 Critical 1160 Critical 10951 Critical 10952 Critical 10729 Critical 10735 Critical 10789 Critical 10788 Critical 10852 Critical 10853 Critical 10047 Critical 10048 Critical 10481 Critical 10482 Critical 10484 Critical 9312 Critical 10287 Critical 9311 Critical 9318 Critical 9344 Critical 10050 Critical 10051 Critical 10049 Critical 10378 Critical 10379 Critical 10483 Critical 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A;Older Software Release:Exploitation More Likely 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10816 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10855 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10951 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10952 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10729 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10735 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10789 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10788 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10852 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10853 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10047 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10048 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10481 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10482 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10484 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 9312 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10287 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 9311 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 9318 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 9344 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10050 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10051 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10049 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10378 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10379 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10483 8.4 7.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10543 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 3213641 https://www.microsoft.com/downloads/details.aspx?familyid=1cb6ed3b-e7b0-48e0-8316-f65b173d44f9 10150 Maybe Security Update 3213638 https://www.microsoft.com/downloads/details.aspx?familyid=eed7d070-3dc7-4e28-883f-fc6019711a90 3191848 10521 Maybe Security Update 3213638 https://www.microsoft.com/downloads/details.aspx?familyid=8edba895-537d-4be9-908b-d8626d021961 3191848 10522 Maybe Security Update 4011134 https://www.microsoft.com/downloads/details.aspx?familyid=08cec781-2b87-44e9-bbf7-ca0579015b66 3203484 1160 Maybe Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9312 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 10287 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9311 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9318 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only Mateusz Jurczyk of <a href="https://www.google.com">Google Project Zero</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> 1.1 2017-09-14T07:00:00Z <p>Added an FAQ to explain why security update 3191848 is not applicable to Office 2010 on Windows Server 2008 and later versions. This is an informational change only. Customers who have already installed the updates do not need to take any further action.</p> Microsoft Graphics Component Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when the Microsoft Windows Graphics Component improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.</p> <p>The update addresses the vulnerability by correcting the way in which the Windows Graphics Component handles objects in memory.</p> Microsoft Graphics Component CVE-2017-8683 10816 10855 10951 10952 10729 10735 10789 10788 10852 10853 10047 10048 10481 10482 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 Information Disclosure 10816 Information Disclosure 10855 Information Disclosure 10951 Information Disclosure 10952 Information Disclosure 10729 Information Disclosure 10735 Information Disclosure 10789 Information Disclosure 10788 Information Disclosure 10852 Information Disclosure 10853 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 10481 Information Disclosure 10482 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Important 10816 Important 10855 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10047 Important 10048 Important 10481 Important 10482 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10816 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10855 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10951 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10952 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10729 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10735 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10789 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10788 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10852 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10853 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10047 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10048 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10481 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10482 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9312 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10287 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9311 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9318 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9344 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10050 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10051 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10049 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10378 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10379 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10483 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10543 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9312 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 10287 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9311 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9318 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only Mateusz Jurczyk of <a href="https://www.google.com">Google Project Zero</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows GDI+ Information Disclosure Vulnerability <p>A information disclosure vulnerability exists when the Windows GDI+ component improperly discloses kernel memory addresses. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.</p> <p>The security update addresses the vulnerability by correcting how the Windows GDI+ component handles objects in memory.</p> Microsoft Graphics Component CVE-2017-8684 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 10481 Information Disclosure 10482 Information Disclosure 10484 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10047 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10048 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10481 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10482 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10484 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9312 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10287 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9311 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9318 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9344 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10050 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10051 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10049 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10378 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10379 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10483 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10543 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9312 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 10287 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9311 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9318 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only Mateusz Jurczyk of <a href="https://www.google.com">Google Project Zero</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows GDI+ Information Disclosure Vulnerability <p>A information disclosure vulnerability exists when the Windows GDI+ component improperly discloses kernel memory addresses. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.</p> <p>The security update addresses the vulnerability by correcting how the Windows GDI+ component handles objects in memory.</p> Microsoft Graphics Component CVE-2017-8685 10047 10048 9312 10287 9311 9318 9344 10050 10051 10049 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Important 10047 Important 10048 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10047 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10048 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9312 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10287 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9311 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9318 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9344 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10050 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10051 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10049 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9312 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 10287 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9311 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9318 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only Mateusz Jurczyk of <a href="https://www.google.com">Google Project Zero</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows DHCP Server Remote Code Execution Vulnerability <p>A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP failover server. An attacker who successfully exploited the vulnerability could either run arbitrary code on the DHCP failover server or cause the DHCP service to become nonresponsive.</p> <p>To exploit the vulnerability, an attacker could send a specially crafted packet to a DHCP server. However, the DHCP server must be set to failover mode for the attack to succeed.</p> <p>The security update addresses the vulnerability by correcting how DHCP failover servers handle network packets.</p> Windows DHCP Server CVE-2017-8686 10816 10855 10378 10379 10483 10543 Remote Code Execution 10816 Remote Code Execution 10855 Remote Code Execution 10378 Remote Code Execution 10379 Remote Code Execution 10483 Remote Code Execution 10543 Critical 10816 Critical 10855 Critical 10378 Critical 10379 Critical 10483 Critical 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 9.8 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10816 9.8 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10855 9.8 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10378 9.8 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10379 9.8 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10483 9.8 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10543 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only <p>The following <a href="https://technet.microsoft.com/library/security/dn848375.aspx#Mitigation">mitigating factors</a> may be helpful in your situation: Customers who have not configured their DHCP server as a failover are not affected by this vulnerability.</p> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> 1.1 2017-09-12T07:00:00Z <p>Added a mitigation stating that customers who have not configured their DHCP server as a failover are not affected by this vulnerability. This is an informational change only.</p> Win32k Information Disclosure Vulnerability <p>An information disclosure vulnerability exists in Windows kernel that could allow an attacker to retrieve information that could lead to a Kernel Address Space Layout Randomization (KASLR) bypass. An attacker who successfully exploited this vulnerability could retrieve the memory address of a kernel object.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.</p> <p>The security update addresses the vulnerability by correcting how the Windows kernel handles memory addresses.</p> Windows Kernel-Mode Drivers CVE-2017-8687 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 Information Disclosure 10951 Information Disclosure 10952 Information Disclosure 10729 Information Disclosure 10735 Information Disclosure 10789 Information Disclosure 10788 Information Disclosure 10852 Information Disclosure 10853 Information Disclosure 10816 Information Disclosure 10855 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 10481 Information Disclosure 10482 Information Disclosure 10484 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10951 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10952 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10729 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10735 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10789 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10788 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10852 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10853 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10816 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10855 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10047 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10048 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10481 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10482 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10484 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9312 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10287 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9311 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9318 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9344 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10050 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10051 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10049 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10378 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10379 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10483 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10543 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9312 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 10287 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9311 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9318 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only Mateusz Jurczyk of <a href="https://www.google.com">Google Project Zero</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows GDI Information Disclosure Vulnerability <p>An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system. By itself, the information disclosure does not allow arbitrary code execution; however, it could allow arbitrary code to be run if the attacker uses it in combination with another vulnerability.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.</p> <p>The security update addresses the vulnerability by correcting how GDI handles memory addresses.</p> Microsoft Graphics Component CVE-2017-8688 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 Information Disclosure 10951 Information Disclosure 10952 Information Disclosure 10729 Information Disclosure 10735 Information Disclosure 10789 Information Disclosure 10788 Information Disclosure 10852 Information Disclosure 10853 Information Disclosure 10816 Information Disclosure 10855 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 10481 Information Disclosure 10482 Information Disclosure 10484 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10951 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10952 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10729 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10735 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10789 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10788 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10852 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10853 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10816 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10855 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10047 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10048 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10481 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10482 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10484 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9312 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10287 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9311 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9318 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9344 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10050 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10051 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10049 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10378 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10379 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10483 5.5 5.0 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10543 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9312 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 10287 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9311 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9318 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only Weibo Wang (<a href="https://twitter.com/ma1fan">@ma1fan</a>) of 360 Skyeye Labs 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Broadcom BCM43xx Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists when the Broadcom chipset in HoloLens improperly handles objects in memory. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit this vulnerability, an attacker would need to send a specially crafted WiFi packet.</p> <p>The update addresses the vulnerability by correcting how the Broadcom chipset in HoloLens handles objects in memory.</p> HoloLens CVE-2017-9417 10852 Remote Code Execution 10852 Important 10852 Publicly Disclosed:Yes;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 8.8 8.2 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C 10852 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 1.0 2017-09-12T07:00:00Z <p>Information published.</p> September 2017 Flash Security Update <p>This security update addresses the following vulnerabilities, which are described in Adobe Security Bulletin <a href="http://helpx.adobe.com/security/products/flash-player/apsb17-28.html">APSB17-28</a>: CVE-2017-11281, CVE-2017-11282.</p> <p><strong>How could an attacker exploit these vulnerabilities?</strong> In a web-based attack scenario where the user is using Internet Explorer for the desktop, an attacker could host a specially crafted website that is designed to exploit any of these vulnerabilities through Internet Explorer and then convince a user to view the website. An attacker could also embed an ActiveX control marked &quot;safe for initialization&quot; in an application or Microsoft Office document that hosts the IE rendering engine. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit any of these vulnerabilities. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by clicking a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email.</p> <p>In a web-based attack scenario where the user is using Internet Explorer in the Windows 8-style UI, an attacker would first need to compromise a website already listed in the Compatibility View (CV) list. An attacker could then host a website that contains specially crafted Flash content designed to exploit any of these vulnerabilities through Internet Explorer and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by clicking a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email. For more information about Internet Explorer and the CV List, please see the MSDN Article, Developer Guidance for websites with content for Adobe Flash Player in Windows 8.</p> Adobe Flash Player ADV170013 10384-10951 10384-10952 10384-10729 10384-10735 10384-10789 10384-10788 10384-10852 10384-10853 10384-10816 10384-10481 10384-10482 10384-10484 10384-10378 10384-10483 Remote Code Execution 10384-10951 Remote Code Execution 10384-10952 Remote Code Execution 10384-10729 Remote Code Execution 10384-10735 Remote Code Execution 10384-10789 Remote Code Execution 10384-10788 Remote Code Execution 10384-10852 Remote Code Execution 10384-10853 Remote Code Execution 10384-10816 Remote Code Execution 10384-10481 Remote Code Execution 10384-10482 Remote Code Execution 10384-10484 Remote Code Execution 10384-10378 Remote Code Execution 10384-10483 Critical 10384-10951 Critical 10384-10952 Critical 10384-10729 Critical 10384-10735 Critical 10384-10789 Critical 10384-10788 Critical 10384-10852 Critical 10384-10853 Critical 10384-10816 Critical 10384-10481 Critical 10384-10482 Critical 10384-10484 Critical 10384-10378 Critical 10384-10483 Publicly Disclosed:No;Exploited:No 4038806 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038806 4034662 10384-10951 Yes Security Update 4038806 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038806 4034662 10384-10952 Yes Security Update 4038806 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038806 4034662 10384-10729 Yes Security Update 4038806 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038806 4034662 10384-10735 Yes Security Update 4038806 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038806 4034662 10384-10789 Yes Security Update 4038806 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038806 4034662 10384-10788 Yes Security Update 4038806 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038806 4034662 10384-10852 Yes Security Update 4038806 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038806 4034662 10384-10853 Yes Security Update 4038806 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038806 4034662 10384-10816 Yes Security Update 4038806 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038806 4034662 10384-10481 Yes Security Update 4038806 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038806 4034662 10384-10482 Yes Security Update 4038806 4034662 10384-10484 Yes Security Update 4038806 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038806 4034662 10384-10378 Yes Security Update 4038806 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038806 4034662 10384-10483 Yes Security Update <p>The following <a href="https://technet.microsoft.com/library/security/dn848375.aspx#Mitigation">mitigating factors</a> may be helpful in your situation:</p> <ul> <li>In a web-based attack scenario where the user is using Internet Explorer for the desktop, an attacker could host a website that contains a webpage that is used to exploit any of these vulnerabilities. In addition, compromised websites and websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit any of these vulnerabilities. In all cases, however, an attacker would have no way to force users to visit these websites. Instead, an attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or instant message that takes users to the attacker's website.</li> <li>Internet Explorer in the Windows 8-style UI will only play Flash content from sites listed on the Compatibility View (CV) list. This restriction requires an attacker to first compromise a website already listed on the CV list. An attacker could then host specially crafted Flash content designed to exploit any of these vulnerabilities through Internet Explorer and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by clicking a link in an email message or in an instant message that takes users to the attacker's website, or by opening an attachment sent through email.</li> <li>By default, all supported versions of Microsoft Outlook and Windows Live Mail open HTML email messages in the Restricted sites zone. The Restricted sites zone, which disables scripts and ActiveX controls, helps reduce the risk of an attacker being able to use any of these vulnerabilities to execute malicious code. If a user clicks a link in an email message, the user could still be vulnerable to exploitation of any of these vulnerabilities through the web-based attack scenario.</li> <li>By default, Internet Explorer on Windows Server 2012 and Windows Server 2012 R2 runs in a restricted mode that is known as <a href="https://technet.microsoft.com/library/dd883248.aspx">Enhanced Security Configuration</a>. This mode can help reduce the likelihood of the exploitation of these Adobe Flash Player vulnerabilities in Internet Explorer.</li> </ul> <p>Workaround refers to a setting or configuration change that would help block known attack vectors before you apply the update.</p> <p><strong>Prevent Adobe Flash Player from running</strong> You can disable attempts to instantiate Adobe Flash Player in Internet Explorer and other applications that honor the kill bit feature, such as Office 2007 and Office 2010, by setting the kill bit for the control in the registry.</p> <p><strong>Warning</strong> If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk. To set the kill bit for the control in the registry, perform the following steps:</p> <ol> <li><p>Paste the following into a text file and save it with the .reg file extension.</p> <pre><code> Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}] &quot;Compatibility Flags&quot;=dword:00000400 [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}] &quot;Compatibility Flags&quot;=dword:00000400 </code></pre> </li> <li><p>Double-click the .reg file to apply it to an individual system.</p> <p>You can also apply this workaround across domains by using Group Policy. For more information about Group Policy, see the TechNet article, Group Policy collection.</p> </li> </ol> <p><strong>Note</strong> You must restart Internet Explorer for your changes to take effect. <strong>Impact of workaround</strong>. There is no impact as long as the object is not intended to be used in Internet Explorer. <strong>How to undo the workaround.</strong> Delete the registry keys that were added in implementing this workaround. <strong>Prevent Adobe Flash Player from running in Internet Explorer through Group Policy</strong> <strong>Note</strong> The Group Policy MMC snap-in can be used to set policy for a machine, for an organizational unit, or for an entire domain. For more information about Group Policy, visit the following Microsoft Web sites:</p> <p><a href="https://technet.microsoft.com/library/hh831791">Group Policy Overview</a> <a href="https://technet.microsoft.com/library/cc737816%28v=ws.10%29.aspx">What is Group Policy Object Editor?</a> <a href="https://technet.microsoft.com/library/cc784165%28v=ws.10%29.aspx">Core Group Policy tools and settings</a></p> <p>To disable Adobe Flash Player in Internet Explorer through Group Policy, perform the following steps: <strong>Note</strong> This workaround does not prevent Flash from being invoked from other applications, such as Microsoft Office 2007 or Microsoft Office 2010.</p> <ol> <li>Open the Group Policy Management Console and configure the console to work with the appropriate Group Policy object, such as local machine, OU, or domain GPO.</li> <li>Navigate to the following node: <strong>Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Add-on Management</strong></li> <li>Double-click <strong>Turn off Adobe Flash in Internet Explorer and prevent applications from using Internet Explorer technology to instantiate Flash objects</strong>.</li> <li>Change the setting to Enabled.</li> <li>Click <strong>Apply</strong> and then click <strong>OK</strong> to return to the Group Policy Management Console.</li> <li>Refresh Group Policy on all systems or wait for the next scheduled Group Policy refresh interval for the settings to take effect. <strong>Prevent Adobe Flash Player from running in Office 2010 on affected systems</strong> <strong>Note</strong> This workaround does not prevent Adobe Flash Player from running in Internet Explorer. <strong>Warning</strong> If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk. For detailed steps that you can use to prevent a control from running in Internet Explorer, see Microsoft Knowledge Base Article 240797. Follow the steps in the article to create a Compatibility Flags value in the registry to prevent a COM object from being instantiated in Internet Explorer.</li> </ol> <p>To disable Adobe Flash Player in Office 2010 only, set the kill bit for the ActiveX control for Adobe Flash Player in the registry using the following steps:</p> <ol> <li>Create a text file named Disable_Flash.reg with the following contents:</li> </ol> <pre><code> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common\COM\Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}] &quot;Compatibility Flags&quot;=dword:00000400 </code></pre> <ol start="2"> <li>Double-click the .reg file to apply it to an individual system.</li> <li><strong>Note</strong> You must restart Internet Explorer for your changes to take effect. You can also apply this workaround across domains by using Group Policy. For more information about Group Policy, see the TechNet article, <a href="http://go.microsoft.com/fwlink/?LinkID=215719">Group Policy collection</a>. <strong>Prevent ActiveX controls from running in Office 2007 and Office 2010</strong></li> </ol> <p>To disable all ActiveX controls in Microsoft Office 2007 and Microsoft Office 2010, including Adobe Flash Player in Internet Explorer, perform the following steps:</p> <ol> <li>Click File, click Options, click Trust Center, and then click Trust Center Settings.</li> <li>Click ActiveX Settings in the left-hand pane, and then select Disable all controls without notifications.</li> <li>Click OK to save your settings. <strong>Impact of workaround</strong>. Office documents that use embedded ActiveX controls may not display as intended. <strong>How to undo the workaround</strong>.</li> </ol> <p>To re-enable ActiveX controls in Microsoft Office 2007 and Microsoft Office 2010, perform the following steps:</p> <ol> <li>Click File, click Options, click Trust Center, and then click Trust Center Settings.</li> <li>Click ActiveX Settings in the left-hand pane, and then deselect Disable all controls without notifications.</li> <li>Click OK to save your settings. <strong>Set Internet and Local intranet security zone settings to &quot;High&quot; to block ActiveX Controls and Active Scripting in these zones</strong> You can help protect against exploitation of these vulnerabilities by changing your settings for the Internet security zone to block ActiveX controls and Active Scripting. You can do this by setting your browser security to High.</li> </ol> <p>To raise the browsing security level in Internet Explorer, perform the following steps:</p> <ol> <li>On the Internet Explorer <strong>Tools</strong> menu, click** Internet Option**s.</li> <li>In the <strong>Internet Options</strong> dialog box, click the <strong>Security</strong> tab, and then click <strong>Internet</strong>.</li> <li>Under <strong>Security level for this zone</strong>, move the slider to <strong>High</strong>. This sets the security level for all websites you visit to High.</li> <li>Click <strong>Local intranet</strong>.</li> <li>Under <strong>Security level for this zone</strong>, move the slider to <strong>High</strong>. This sets the security level for all websites you visit to High.</li> <li>Click <strong>OK</strong> to accept the changes and return to Internet Explorer. <strong>Note</strong> If no slider is visible, click <strong>Default Level</strong>, and then move the slider to <strong>High</strong>. <strong>Note</strong> Setting the level to High may cause some websites to work incorrectly. If you have difficulty using a website after you change this setting, and you are sure the site is safe to use, you can add that site to your list of trusted sites. This will allow the site to work correctly even with the security setting set to High. <strong>Impact of workaround</strong>. There are side effects to blocking ActiveX Controls and Active Scripting. Many websites on the Internet or an intranet use ActiveX or Active Scripting to provide additional functionality. For example, an online e-commerce site or banking site may use ActiveX Controls to provide menus, ordering forms, or even account statements. Blocking ActiveX Controls or Active Scripting is a global setting that affects all Internet and intranet sites. If you do not want to block ActiveX Controls or Active Scripting for such sites, use the steps outlined in &quot;Add sites that you trust to the Internet Explorer Trusted sites zone&quot;. <strong>Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone</strong></li> </ol> <p>You can help protect against exploitation of these vulnerabilities by changing your settings to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone. To do this, perform the following steps:</p> <ol> <li>In Internet Explorer, click <strong>Internet Options</strong> on the <strong>Tools</strong> menu.</li> <li>Click the <strong>Security</strong> tab.</li> <li>Click <strong>Internet</strong>, and then click <strong>Custom Level</strong>.</li> <li>Under <strong>Settings</strong>, in the <strong>Scripting</strong> section, under <strong>Active Scripting</strong>, click <strong>Prompt</strong> or <strong>Disable</strong>, and then click <strong>OK</strong>.</li> <li>Click <strong>Local intranet</strong>, and then click <strong>Custom Level</strong>.</li> <li>Under <strong>Settings</strong>, in the <strong>Scripting</strong> section, under <strong>Active Scripting</strong>, click <strong>Prompt</strong> or <strong>Disable</strong>, and then click <strong>OK</strong>.</li> <li>Click <strong>OK</strong> to return to Internet Explorer, and then click <strong>OK</strong> again. <strong>Note</strong> Disabling Active Scripting in the Internet and Local intranet security zones may cause some websites to work incorrectly. If you have difficulty using a website after you change this setting, and you are sure the site is safe to use, you can add that site to your list of trusted sites. This will allow the site to work correctly. <strong>Impact of workaround</strong>. There are side effects to prompting before running Active Scripting. Many websites that are on the Internet or on an intranet use Active Scripting to provide additional functionality. For example, an online e-commerce site or banking site may use Active Scripting to provide menus, ordering forms, or even account statements. Prompting before running Active Scripting is a global setting that affects all Internet and intranet sites. You will be prompted frequently when you enable this workaround. For each prompt, if you feel you trust the site that you are visiting, click <strong>Yes</strong> to run Active Scripting. If you do not want to be prompted for all these sites, use the steps outlined in &quot;Add sites that you trust to the Internet Explorer Trusted sites zone&quot;. <strong>Add sites that you trust to the Internet Explorer Trusted sites zone</strong> After you set Internet Explorer to require a prompt before it runs ActiveX controls and Active Scripting in the Internet zone and in the Local intranet zone, you can add sites that you trust to the Internet Explorer Trusted sites zone. This will allow you to continue to use trusted websites exactly as you do today, while helping to protect you from this attack on untrusted sites. We recommend that you add only sites that you trust to the Trusted sites zone.</li> </ol> <p>To do this, perform the following steps:</p> <ol> <li>In Internet Explorer, click <strong>Tools</strong>, click <strong>Internet Options</strong>, and then click the <strong>Security</strong> tab.</li> <li>In the <strong>Select a web content zone to specify its current security settings</strong> box, click <strong>Trusted Sites</strong>, and then click <strong>Sites</strong>.</li> <li>If you want to add sites that do not require an encrypted channel, click to clear the <strong>Require server verification (https:) for all sites in this zone</strong> check box.</li> <li>In the <strong>Add this website to the zone</strong> box, type the URL of a site that you trust, and then click <strong>Add</strong>.</li> <li>Repeat these steps for each site that you want to add to the zone.</li> <li>Click <strong>OK</strong> two times to accept the changes and return to Internet Explorer. <strong>Note</strong> Add any sites that you trust not to take malicious action on your system. Two sites in particular that you may want to add are *<strong>.windowsupdate.microsoft.com</strong> and *<strong>.update.microsoft.com</strong>. These are the sites that will host the update, and they require an ActiveX control to install the update.</li> </ol> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Office Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user.</p> <p>To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Office handles files in memory.</p> Microsoft Office CVE-2017-8744 10753 10754 10150 10521 10522 10603 10601 10602 Remote Code Execution 10753 Remote Code Execution 10754 Remote Code Execution 10150 Remote Code Execution 10521 Remote Code Execution 10522 Remote Code Execution 10603 Remote Code Execution 10601 Remote Code Execution 10602 Important 10753 Important 10754 Important 10150 Important 10521 Important 10522 Important 10603 Important 10601 Important 10602 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely 3213551 https://www.microsoft.com/downloads/details.aspx?familyid=1f72371a-cff9-4171-9c86-7ac44915c4fa 3203383 10753 Maybe Security Update 3213551 https://www.microsoft.com/downloads/details.aspx?familyid=c45d7385-eef7-419c-aee9-1e3c88b940d3 3203383 10754 Maybe Security Update 3213646 https://www.microsoft.com/downloads/details.aspx?familyid=3ee38735-10da-418b-baa5-9aa48065cc24 10150 Maybe Security Update 3213626 https://www.microsoft.com/downloads/details.aspx?familyid=fa01d45d-0996-4ea9-9265-4d08026f6903 3203461 10521 Maybe Security Update 3213626 https://www.microsoft.com/downloads/details.aspx?familyid=b4cc83d5-2c14-41e6-82f9-c0241da3c68a 3203461 10522 Maybe Security Update 3213564 3203392 10603 Maybe Security Update 3213564 https://www.microsoft.com/downloads/details.aspx?familyid=7b974e84-142a-403a-9647-e9755915bd47 10601 Maybe Security Update 3213564 https://www.microsoft.com/downloads/details.aspx?familyid=23c4c638-8a56-42c7-84b9-77be313c04b7 10602 Maybe Security Update MSRC Vulnerabilities and Mitigations Team Lucas Leong of Trend Micro working with <a href="http://www.zerodayinitiative.com/">Trend Micro's Zero Day Initiative</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft SharePoint Elevation of Privilege Vulnerability <p>An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server.</p> <p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. These attacks could allow the attacker to read content that the attacker is not authorized to read, use the victim's identity to take actions on the SharePoint site on behalf of the user, such as change permissions and delete content, and inject malicious content in the browser of the user.</p> <p>The security update addresses the vulnerability by helping to ensure that SharePoint Server properly sanitizes web requests.</p> Microsoft Office CVE-2017-8745 10612 Elevation of Privilege 10612 Important 10612 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation Unlikely 4011117 file://officerel/releases/office15/signed/serverqfepatch/x-none/15.0.4963.1000_pptserverloc-security-exe_ 10612 Maybe Security Update 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows PDF Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit the vulnerability on Windows 10 systems with Microsoft Edge set as the default browser, an attacker could host a specially crafted website that contains malicious PDF content and then convince users to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted PDF content to such sites. Only Windows 10 systems with Microsoft Edge set as the default browser can be compromised simply by viewing a website. The browsers for all other affected operating systems do not automatically render PDF content, so an attacker would have no way to force users to view attacker-controlled content. Instead, an attacker would have to convince users to open a specially crafted PDF document, typically by way of an enticement in an email or instant message or by way of an email attachment.</p> <p>The update addresses the vulnerability by modifying how affected systems handle objects in memory.</p> Microsoft Windows PDF CVE-2017-8737 10481 10482 10484 10378 10379 10483 10543 10724-10951 10724-10952 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 Remote Code Execution 10481 Remote Code Execution 10482 Remote Code Execution 10484 Remote Code Execution 10378 Remote Code Execution 10379 Remote Code Execution 10483 Remote Code Execution 10543 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Remote Code Execution 10724-10729 Remote Code Execution 10724-10735 Remote Code Execution 10724-10789 Remote Code Execution 10724-10788 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Critical 10481 Critical 10482 Critical 10484 Moderate 10378 Moderate 10379 Moderate 10483 Moderate 10543 Critical 10724-10951 Critical 10724-10952 Critical 10724-10729 Critical 10724-10735 Critical 10724-10789 Critical 10724-10788 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Publicly Disclosed:No;Exploited:No 2.6 2.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10481 2.6 2.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10482 2.6 2.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10484 2.6 2.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10378 2.6 2.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10379 2.6 2.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10483 2.6 2.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10543 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10729 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10735 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update Ke Liu of Tencent’s <a href=”http://www.tencent.com”>Xuanwu Lab</a> Giwan Go of STEALIEN & HIT working with <a href="http://www.zerodayinitiative.com/">Trend Micro's Zero Day Initiative</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Scripting Engine Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked &quot;safe for initialization&quot; in an application or Microsoft Office document that hosts the related rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p> <p>An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>The security update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines handle objects in memory.</p> Microsoft Scripting Engine CVE-2017-8748 10724-10816 10724-10951 10724-10952 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 10486-10951 10486-10952 10486-10729 10486-10735 10486-10789 10486-10788 10486-10852 10486-10853 10486-10816 10486-10047 10486-10048 10486-10481 10486-10482 10486-10484 10486-10051 10486-10483 Remote Code Execution 10724-10816 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Remote Code Execution 10724-10729 Remote Code Execution 10724-10735 Remote Code Execution 10724-10789 Remote Code Execution 10724-10788 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10486-10951 Remote Code Execution 10486-10952 Remote Code Execution 10486-10729 Remote Code Execution 10486-10735 Remote Code Execution 10486-10789 Remote Code Execution 10486-10788 Remote Code Execution 10486-10852 Remote Code Execution 10486-10853 Remote Code Execution 10486-10816 Remote Code Execution 10486-10047 Remote Code Execution 10486-10048 Remote Code Execution 10486-10481 Remote Code Execution 10486-10482 Remote Code Execution 10486-10484 Remote Code Execution 10486-10051 Remote Code Execution 10486-10483 Moderate 10724-10816 Critical 10724-10951 Critical 10724-10952 Critical 10724-10729 Critical 10724-10735 Critical 10724-10789 Critical 10724-10788 Critical 10724-10852 Critical 10724-10853 Critical 10486-10951 Critical 10486-10952 Critical 10486-10729 Critical 10486-10735 Critical 10486-10789 Critical 10486-10788 Critical 10486-10852 Critical 10486-10853 Moderate 10486-10816 Critical 10486-10047 Critical 10486-10048 Critical 10486-10481 Critical 10486-10482 Critical 10486-10484 Moderate 10486-10051 Moderate 10486-10483 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10729 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10735 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10729 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10735 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10853 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10816 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10047 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10048 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10481 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10482 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10484 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10051 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10483 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10486-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10486-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10486-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10486-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10486-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10486-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10816 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10047 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10047 Yes IE Cumulative 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10048 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10048 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10481 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10481 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10482 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10482 Yes IE Cumulative 4038792 4034681 10486-10484 Yes Monthly Rollup 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10051 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10051 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10483 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10483 Yes IE Cumulative 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Exchange Server Elevation of Privilege Vulnerability <p>An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive information.</p> <p>To exploit the vulnerability, an attacker could send a specially crafted email message containing a malicious link to a user. Alternatively, an attacker could use a chat client to social engineer a user into clicking the malicious link.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Exchange validates web requests.</p> <p>Note: In order to exploit this vulnerability, a user must click a maliciously crafted link from an attacker.</p> Microsoft Exchange Server CVE-2017-8758 11450 Elevation of Privilege 11450 Important 11450 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation Unlikely 4036108 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036108 11450 Yes Security Update Cem Onat Karagun <a href="https://www.linkedin.com/in/cemkaragun">Kocaeli University</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Office Defense in Depth Update <p>Microsoft has released an update for Microsoft Office that provides enhanced security as a defense in depth measure.</p> Microsoft Office ADV170015 10765 10766 10156 10527 10528 10317 10318 10407 10753 10754 10150 10521 10522 10603 10601 10602 Defense in Depth 10765 Defense in Depth 10766 Defense in Depth 10156 Defense in Depth 10527 Defense in Depth 10528 Defense in Depth 10317 Defense in Depth 10318 Defense in Depth 10407 Defense in Depth 10753 Defense in Depth 10754 Defense in Depth 10150 Defense in Depth 10521 Defense in Depth 10522 Defense in Depth 10603 Defense in Depth 10601 Defense in Depth 10602 None 10765 None 10766 None 10156 None 10527 None 10528 None 10317 None 10318 None 10407 None 10753 None 10754 None 10150 None 10521 None 10522 None 10603 None 10601 None 10602 Publicly Disclosed:Yes;Exploited:Yes 4011091 https://www.microsoft.com/downloads/details.aspx?familyid=d959bb1e-5d99-40b9-8429-728e929eeb2d 4011052 10765 Maybe Security Update 4011091 https://www.microsoft.com/downloads/details.aspx?familyid=6f32c25a-394d-46c1-ad44-b0c2a5edde4e 4011052 10766 Maybe Security Update 4011110 https://www.microsoft.com/downloads/details.aspx?familyid=df1c2665-07ef-49c5-b6c3-2694e220d870 3213643 10156 Maybe Security Update 4011089 https://www.microsoft.com/downloads/details.aspx?familyid=5b664c50-281c-49e0-9e01-c7739f3e666d 2956078 10527 Maybe Security Update 4011089 https://www.microsoft.com/downloads/details.aspx?familyid=d08e77bd-75c2-46b9-a078-60327d671cad 2956078 10528 Maybe Security Update 4011090 https://www.microsoft.com/downloads/details.aspx?familyid=0b0f7bd5-2dd6-4ffb-bb69-e78ba1104529 4011078 10317 Maybe Security Update 4011090 https://www.microsoft.com/downloads/details.aspx?familyid=0d8d5f78-5e72-4f7d-b5be-2cda27a5840b 4011078 10318 Maybe Security Update 4011090 4011078 10407 Maybe Security Update 4011126 https://www.microsoft.com/downloads/details.aspx?familyid=13454632-9f4e-475d-8f75-b80d5e5106b1 3213545 10753 Maybe Security Update 4011038 https://www.microsoft.com/downloads/details.aspx?familyid=9f080d17-34a0-4bbc-a573-3945d5928017 3191943 10753 Maybe Security Update 4011126 https://www.microsoft.com/downloads/details.aspx?familyid=9385e2fa-e7e3-42e0-9443-250db4c17c1e 3213545 10754 Maybe Security Update 4011038 https://www.microsoft.com/downloads/details.aspx?familyid=1be5a597-e746-4c16-aaff-586ee9444d4a 3191943 10754 Maybe Security Update 4011063 https://www.microsoft.com/downloads/details.aspx?familyid=e38d4b14-1039-48d4-9638-a92552b42f8b 10150 Maybe Security Update 4011055 https://www.microsoft.com/downloads/details.aspx?familyid=9a70aa12-3823-44e7-8cf9-2072887509c1 3213624 10521 Maybe Security Update 4011055 https://www.microsoft.com/downloads/details.aspx?familyid=ad2d2112-8beb-45f5-baed-9d4b9ffeeca5 3213624 10522 Maybe Security Update 4011103 3213555 10603 Maybe Security Update 4011103 https://www.microsoft.com/downloads/details.aspx?familyid=c5ed8bb3-6908-44ee-bfc9-97fa0dd05a55 3213555 10601 Maybe Security Update 4011103 https://www.microsoft.com/downloads/details.aspx?familyid=b35f062a-ea19-432a-8875-34ff2a3edc0c 3213555 10602 Maybe Security Update 1.0 2017-09-12T07:00:00Z <p>Information published.</p> 2.0 2017-09-19T07:00:00Z <p>Information updated to announce that Microsoft is replacing KB4011086 for Microsoft Outlook 2007 Service Pack 3 with KB401110. Note that you must first uninstall KB4011086 and then install KB401110. For more information, see https://support.microsoft.com/help/4011110.</p> NetBIOS Remote Code Execution Vulnerability <p>A race condition that could lead to a remote code execution vulnerability exists in NetBT Session Services when NetBT fails to maintain certain sequencing requirements. To exploit the vulnerability, an attacker needs to be able to send specially crafted NetBT Session Service packets to an impacted system.</p> <p>An attacker who successfully exploits the vulnerability could execute arbitrary code on the target.</p> <p>The security update addresses the vulnerability by correcting how NetBT sequences certain operations.</p> Windows NetBIOS CVE-2017-0161 10951 10729 10789 10852 10853 10047 10048 10481 10482 10484 10050 10051 10049 10378 10379 10816 10952 10735 10788 10483 10543 10855 Remote Code Execution 10951 Remote Code Execution 10729 Remote Code Execution 10789 Remote Code Execution 10852 Remote Code Execution 10853 Remote Code Execution 10047 Remote Code Execution 10048 Remote Code Execution 10481 Remote Code Execution 10482 Remote Code Execution 10484 Remote Code Execution 10050 Remote Code Execution 10051 Remote Code Execution 10049 Remote Code Execution 10378 Remote Code Execution 10379 Remote Code Execution 10816 Remote Code Execution 10952 Remote Code Execution 10735 Remote Code Execution 10788 Remote Code Execution 10483 Remote Code Execution 10543 Remote Code Execution 10855 Critical 10951 Critical 10729 Critical 10789 Critical 10852 Critical 10853 Critical 10047 Critical 10048 Critical 10481 Critical 10482 Critical 10484 Critical 10050 Critical 10051 Critical 10049 Critical 10378 Critical 10379 Critical 10816 Critical 10952 Critical 10735 Critical 10788 Critical 10483 Critical 10543 Critical 10855 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation Unlikely 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10951 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10729 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10789 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10852 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10853 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10047 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10048 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10481 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10482 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10484 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10050 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10051 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10049 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10816 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10952 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10735 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10788 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10483 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10543 8.1 7.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10855 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update <p><strong>Block TCP port 139 at the firewall</strong> This port is used to initiate a connection with the affected component. Blocking TCP port 139 at the firewall will help protect systems that are behind that firewall from attempts to exploit this vulnerability. Microsoft recommends that you block all unsolicited inbound communication from the Internet to help prevent attacks that may use other ports. For more information about ports, see the TechNet article, <a href="http://go.microsoft.com/fwlink/?LinkId=21312">TCP and UDP Port Assignments</a>.</p> <p><strong>Impact of workaround</strong>. Several Windows services use the affected port. Blocking connectivity to the port may cause various applications or services to not function. Some of the applications or services that could be impacted are listed below:</p> <ul> <li>Applications that use SMB (CIFS)</li> <li>Applications that use mailslots or named pipes (RPC over SMB)</li> <li>Server (File and Print Sharing)</li> <li>Group Policy</li> <li>Net Logon</li> <li>Distributed File System (DFS)</li> <li>Terminal Server Licensing</li> <li>Print Spooler</li> <li>Computer Browser</li> <li>Remote Procedure Call Locator</li> <li>Fax Service</li> <li>Indexing Service</li> <li>Performance Logs and Alerts</li> <li>Systems Management Server</li> <li>License Logging Service</li> </ul> <p><strong>How to undo the workaround</strong>. Unblock TCP port 139 at the firewall. For more information about ports, see <a href="http://go.microsoft.com/fwlink/?LinkId=21312">TCP and UDP Port Assignments</a>.</p> Peter Hlavaty (<a href="https://twitter.com/zer0mem">@zer0mem</a>), KeenLab, <a href="http://keenlab.tencent.com/en/">Tencent</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Office Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.</p> <p>Note that the Preview Pane is not an attack vector for this vulnerability.</p> <p>The security update addresses the vulnerability by correcting how Office handles objects in memory.</p> Microsoft Office CVE-2017-8567 10027 Remote Code Execution 10027 Important 10027 Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A;Older Software Release:Exploitation Unlikely 3212225 https://go.microsoft.com/fwlink/?linkid=853610 10027 No Security Update Jin Chen of <a href="https://www.paloaltonetworks.com/">Paloaltonetworks</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Bluetooth Driver Spoofing Vulnerability <p>A spoofing vulnerability exists in Microsoft's implementation of the Bluetooth stack. An attacker who successfully exploited this vulnerability could perform a <a href="https://technet.microsoft.com/en-us/library/security/dn848375.aspx#MiTM">man-in-the-middle attack</a> and force a user's computer to unknowingly route traffic through the attacker's computer. The attacker can then monitor and read the traffic before sending it on to the intended recipient.</p> <p>To exploit the vulnerability, the attacker needs to be within the physical proximity of the targeted user, and the user's computer needs to have Bluetooth enabled. The attacker can then initiate a Bluetooth connection to the target computer without the user's knowledge.</p> <p>The security update addresses the vulnerability by correcting how Windows handles Bluetooth requests.</p> Microsoft Bluetooth Driver CVE-2017-8628 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 Spoofing 10951 Spoofing 10952 Spoofing 10729 Spoofing 10735 Spoofing 10789 Spoofing 10788 Spoofing 10852 Spoofing 10853 Spoofing 10816 Spoofing 10855 Spoofing 10047 Spoofing 10048 Spoofing 10481 Spoofing 10482 Spoofing 10484 Spoofing 9312 Spoofing 10287 Spoofing 9311 Spoofing 9318 Spoofing 9344 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10951 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10952 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10729 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10735 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10789 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10788 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10852 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10853 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10816 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10855 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10047 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10048 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10481 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10482 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10484 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 9312 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 10287 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 9311 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 9318 8.1 7.3 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C 9344 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4025337 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4025337 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4025337 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4025337 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4025333 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4025333 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4025333 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4025333 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4034786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034786 4019276 9312 Yes Security Update 4034786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034786 4019276 10287 Yes Security Update 4034786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034786 9311 Yes Security Update 4034786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034786 4019276 9318 Yes Security Update 4034786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4034786 4019276 9344 Yes Security Update Ben Seri and Gregory Vishnepolsky of <a href="https://armis.com">Armis, Inc.</a> 2.0 2017-09-26T07:00:00Z <p>Information updated to correct package KB numbers for the Security Updates for affected editions of Windows 7 and Windows 8.1. Microsoft released security updates to address CVE-2017-8628 on July 11, 2017, and because it is one of a group of vulnerabilities collectively known as “BlueBorne” affecting software from multiple vendors, Microsoft published the CVE on September 12, 2017 as part of an industry-wide coordinated disclosure to remediate the vulnerability. Customers running Microsoft Windows need only to install the Windows updates that are offered to be protected from this vulnerability. Customers running Windows 7 or Windows 8.1 who have not installed the September Monthly Rollup should install either the July Security Update or the September Monthly Rollup to be protected from this vulnerability. Customers running other affected versions of Windows who have already successfully installed the September Security Updates do not need to take any further action.</p> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Edge Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when Microsoft Edge improperly handles clipboard events.</p> <p>For an attack to be successful, an attacker must persuade a user to visit a malicious website and leave it open during clipboard activities.</p> <p>The update addresses the vulnerability by changing how Microsoft Edge handles clipboard events in the browser.</p> Microsoft Edge CVE-2017-8643 10724-10816 10724-10951 10724-10952 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 Information Disclosure 10724-10816 Information Disclosure 10724-10951 Information Disclosure 10724-10952 Information Disclosure 10724-10729 Information Disclosure 10724-10735 Information Disclosure 10724-10789 Information Disclosure 10724-10788 Information Disclosure 10724-10852 Information Disclosure 10724-10853 Low 10724-10816 Important 10724-10951 Important 10724-10952 Important 10724-10729 Important 10724-10735 Important 10724-10789 Important 10724-10788 Important 10724-10852 Important 10724-10853 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 2.4 2.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10816 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10951 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10952 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10729 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10735 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10789 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10788 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10852 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10853 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update Giorgi Maisuradze, <a href="https://cispa.saarland/">CISPA</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Edge based on Edge HTML Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit the vulnerability, in a web-based attack scenario, an attacker could host a website in an attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could trick a user into clicking a link that takes the user to the attacker's site.</p> <p>The update addresses the vulnerability by modifying how Microsoft Edge based on Edge HTML handles objects in memory.</p> Microsoft Edge CVE-2017-8648 10724-10951 10724-10952 Information Disclosure 10724-10951 Information Disclosure 10724-10952 Important 10724-10951 Important 10724-10952 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10951 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10952 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update Maksymilian Motyl from <a href="https://www.cert.orange.pl/">CERT Orange Poland</a> Zhong Zhaochen (<a href="http://asnine.com">@asnine</a>) of <a href="http://www.neusoft.com/">Neusoft</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Scripting Engine Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked &quot;safe for initialization&quot; in an application or Microsoft Office document that hosts the related rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p> <p>An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>The security update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines handle objects in memory.</p> Microsoft Scripting Engine CVE-2017-8649 10724-10951 10724-10952 10724-10852 10724-10853 10724-10816 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Critical 10724-10951 Critical 10724-10952 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update Microsoft ChakraCore Team 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Scripting Engine Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked &quot;safe for initialization&quot; in an application or Microsoft Office document that hosts the related rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p> <p>An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>The security update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines handle objects in memory.</p> Microsoft Scripting Engine CVE-2017-8660 10724-10951 10724-10952 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Remote Code Execution 10724-10789 Remote Code Execution 10724-10788 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Critical 10724-10951 Critical 10724-10952 Critical 10724-10789 Critical 10724-10788 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update Microsoft ChakraCore Team 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Uniscribe Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists due to the way Windows Uniscribe handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>There are multiple ways an attacker could exploit this vulnerability:</p> <ul> <li><p>In a web-based attack scenario, an attacker could host a specially crafted website designed to exploit this vulnerability and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email or instant message that takes users to the attacker's website, or by opening an attachment sent through email.</p> </li> <li><p>In a file-sharing attack scenario, an attacker could provide a specially crafted document file designed to exploit this vulnerability and then convince a user to open the document file.</p> </li> </ul> <p>The security update addresses the vulnerability by correcting how Windows Uniscribe handles objects in memory.</p> Microsoft Uniscribe CVE-2017-8692 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10481 10482 10484 10378 10379 10483 10543 Remote Code Execution 10951 Remote Code Execution 10952 Remote Code Execution 10729 Remote Code Execution 10735 Remote Code Execution 10789 Remote Code Execution 10788 Remote Code Execution 10852 Remote Code Execution 10853 Remote Code Execution 10816 Remote Code Execution 10855 Remote Code Execution 10481 Remote Code Execution 10482 Remote Code Execution 10484 Remote Code Execution 10378 Remote Code Execution 10379 Remote Code Execution 10483 Remote Code Execution 10543 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10481 Important 10482 Important 10484 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10951 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10952 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10729 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10735 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10789 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10788 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10852 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10853 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10816 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10855 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10481 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10482 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10484 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10378 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10379 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10483 5.0 4.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10543 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only Yong Chuan Koh (@yongchuank) of <a href="https://labs.mwrinfosecurity.com/">MWR Labs</a> Jaanus Kp Clarified Security working with <a href="http://www.zerodayinitiative.com/">Trend Micro's Zero Day Initiative</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Uniscribe Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when Windows Uniscribe improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p> <p>There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document or by convincing a user to visit an untrusted webpage.</p> <p>The update addresses the vulnerability by correcting how Windows Uniscribe handles objects in memory.</p> <p><strong>I am being offered this update for software that is not specifically indicated as being affected in the Affected Software and Vulnerability Severity Ratings table. Why am I being offered this update?</strong></p> <p>When updates address vulnerable code that exists in a component that is shared between multiple Microsoft Office products or shared between multiple versions of the same Microsoft Office product, the update is considered to be applicable to all supported products and versions that contain the vulnerable component.</p> <p>For example, when an update applies to Microsoft Office 2007 products, only Microsoft Office 2007 may be specifically listed in the Affected Software table. However, the update could apply to Microsoft Word 2007, Microsoft Excel 2007, Microsoft Visio 2007, Microsoft Compatibility Pack, Microsoft Excel Viewer, or any other Microsoft Office 2007 product that is not specifically listed in the Affected Software table. Furthermore, when an update applies to Microsoft Office 2010 products, only Microsoft Office 2010 may be specifically listed in the Affected Software table. However, the update could apply to Microsoft Word 2010, Microsoft Excel 2010, Microsoft Visio 2010, Microsoft Visio Viewer, or any other Microsoft Office 2010 product that is not specifically listed in the Affected Software table.</p> <p>For more information on this behavior and recommended actions, see <a href="https://support.microsoft.com/kb/830335">Microsoft Knowledge Base Article 830335</a>. For a list of Microsoft Office products that an update may apply to, refer to the Microsoft Knowledge Base Article associated with the specific update.</p> Microsoft Graphics Component CVE-2017-8695 10628 10630 10629 10631 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 10150 10521 10522 1160 10956 10770 10771 10772 10773 10290 10069 10303 10268 10295 Information Disclosure 10628 Information Disclosure 10630 Information Disclosure 10629 Information Disclosure 10631 Information Disclosure 10951 Information Disclosure 10952 Information Disclosure 10729 Information Disclosure 10735 Information Disclosure 10789 Information Disclosure 10788 Information Disclosure 10852 Information Disclosure 10853 Information Disclosure 10816 Information Disclosure 10855 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 10481 Information Disclosure 10482 Information Disclosure 10484 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Information Disclosure 10150 Information Disclosure 10521 Information Disclosure 10522 Information Disclosure 1160 Information Disclosure 10956 Information Disclosure 10770 Information Disclosure 10771 Information Disclosure 10772 Information Disclosure 10773 Information Disclosure 10290 Information Disclosure 10069 Information Disclosure 10303 Information Disclosure 10268 Information Disclosure 10295 Important 10628 Important 10630 Important 10629 Important 10631 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Important 10150 Important 10521 Important 10522 Important 1160 Important 10956 Important 10770 Important 10771 Important 10772 Important 10773 Important 10290 Important 10069 Important 10303 Important 10268 Important 10295 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10951 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10952 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10729 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10735 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10789 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10788 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10852 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10853 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10816 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10855 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10047 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10048 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10481 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10482 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10484 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 9312 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10287 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 9311 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 9318 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 9344 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10050 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10051 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10049 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10378 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10379 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10483 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10543 4011107 https://www.microsoft.com/downloads/details.aspx?familyid=34d3be9d-8fe2-4bac-a0a9-86d790b748fe 3191939 10628 Maybe Security Update 4011107 https://www.microsoft.com/downloads/details.aspx?familyid=e2465f08-7003-4c31-b390-ee0ad19f4b78 3191939 10630 Maybe Security Update 4011107 https://www.microsoft.com/downloads/details.aspx?familyid=34d3be9d-8fe2-4bac-a0a9-86d790b748fe 3191939 10629 Maybe Security Update 4011107 https://www.microsoft.com/downloads/details.aspx?familyid=e2465f08-7003-4c31-b390-ee0ad19f4b78 3191939 10631 Maybe Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9312 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 10287 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9311 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9318 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only 3213641 https://www.microsoft.com/downloads/details.aspx?familyid=1cb6ed3b-e7b0-48e0-8316-f65b173d44f9 10150 Maybe Security Update 3213638 https://www.microsoft.com/downloads/details.aspx?familyid=eed7d070-3dc7-4e28-883f-fc6019711a90 3191848 10521 Maybe Security Update 3213638 https://www.microsoft.com/downloads/details.aspx?familyid=8edba895-537d-4be9-908b-d8626d021961 3191848 10522 Maybe Security Update 4011134 https://www.microsoft.com/downloads/details.aspx?familyid=08cec781-2b87-44e9-bbf7-ca0579015b66 3203484 1160 Maybe Security Update 4025869 http://support.microsoft.com/kb/4025869 4020736 10956 Security Update 4011040 https://www.microsoft.com/downloads/details.aspx?familyid=f9b16fc9-d311-4e89-b8ca-1c8885488b06 3203382 10770 Maybe Security Update 4011040 https://www.microsoft.com/downloads/details.aspx?familyid=71a1182f-d498-45ca-a827-6aa17147f22d 3203382 10771 Maybe Security Update 4011040 https://www.microsoft.com/downloads/details.aspx?familyid=f9b16fc9-d311-4e89-b8ca-1c8885488b06 3203382 10772 Maybe Security Update 4011040 https://www.microsoft.com/downloads/details.aspx?familyid=71a1182f-d498-45ca-a827-6aa17147f22d 3203382 10773 Maybe Security Update 4025868 http://support.microsoft.com/kb/4025868 4020735 10290 Maybe Security Update 4025865 https://www.microsoft.com/downloads/details.aspx?familyid=f145b833-309f-49c6-b664-4155a216150d 4020732 10069 Maybe Security Update 4025865 https://www.microsoft.com/downloads/details.aspx?familyid=31ce5e7d-19cf-4838-9c30-791f4cdff4ce 4020732 10303 Maybe Security Update 4025866 https://www.microsoft.com/downloads/details.aspx?familyid=8e4ef5f4-f86d-4a70-b315-53d5eb596e1c 4020733 10268 Maybe Security Update 4025867 https://www.microsoft.com/downloads/details.aspx?familyid=76de234f-ebf5-4294-b6e2-577d7dcf9e3d 4020734 10295 Maybe Security Update Axel Souchet (<a href="https://twitter.com/0vercl0k">@0vercl0k</a>) of MSRC Vulnerabilities and Mitigations Team 1.1 2017-09-14T07:00:00Z <p>Added an FAQ to explain why security update 3191848 is not applicable to Office 2010 on Windows Server 2008 and later versions. This is an informational change only. Customers who have already installed the updates do not need to take any further action.</p> 2.0 2017-10-04T07:00:00Z <p>Removed security update 3213568 for Microsoft Lync Basic 2013 Service Pack 1 (32-bit), Microsoft Lync Basic 2013 Service Pack 1 (64-bit), Microsoft Lync 2013 Service Pack 1 (32-bit), and Microsoft Lync 2013 Service Pack 1 (64-bit) from the Affected Products table because it is not required to address CVE-2017-8695. Customers running these affected versions of Microsoft Lync who have already successfully installed the September Security Updates do not need to take any further action.</p> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Uniscribe Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists due to the way Windows Uniscribe handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>There are multiple ways an attacker could exploit this vulnerability:</p> <ul> <li><p>In a web-based attack scenario, an attacker could host a specially crafted website designed to exploit this vulnerability and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email or instant message that takes users to the attacker's website, or by opening an attachment sent through email.</p> </li> <li><p>In a file-sharing attack scenario, an attacker could provide a specially crafted document file designed to exploit this vulnerability and then convince a user to open the document file.</p> </li> </ul> <p>The security update addresses the vulnerability by correcting how Windows Uniscribe handles objects in memory.</p> Microsoft Graphics Component CVE-2017-8696 10047 10048 9312 10287 9311 9318 9344 10050 10051 10049 10150 10521 10522 10525 1160 10956 10770 10771 10772 10773 10290 10069 10303 10268 10295 10628 10630 10629 10631 Remote Code Execution 10047 Remote Code Execution 10048 Remote Code Execution 9312 Remote Code Execution 10287 Remote Code Execution 9311 Remote Code Execution 9318 Remote Code Execution 9344 Remote Code Execution 10050 Remote Code Execution 10051 Remote Code Execution 10049 Remote Code Execution 10150 Remote Code Execution 10521 Remote Code Execution 10522 Remote Code Execution 10525 Remote Code Execution 1160 Remote Code Execution 10956 Remote Code Execution 10770 Remote Code Execution 10771 Remote Code Execution 10772 Remote Code Execution 10773 Remote Code Execution 10290 Remote Code Execution 10069 Remote Code Execution 10303 Remote Code Execution 10268 Remote Code Execution 10295 Remote Code Execution 10628 Remote Code Execution 10630 Remote Code Execution 10629 Remote Code Execution 10631 Critical 10047 Critical 10048 Critical 9312 Critical 10287 Critical 9311 Critical 9318 Critical 9344 Critical 10050 Critical 10051 Critical 10049 Critical 10150 Critical 10521 Critical 10522 Critical 10525 Critical 1160 Important 10956 Important 10770 Important 10771 Important 10772 Important 10773 Important 10290 Important 10069 Important 10303 Important 10268 Important 10295 Important 10628 Important 10630 Important 10629 Important 10631 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10047 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10048 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 9312 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10287 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 9311 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 9318 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 9344 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10050 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10051 7.5 6.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10049 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9312 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 10287 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9311 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9318 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 3213649 https://www.microsoft.com/downloads/details.aspx?familyid=0ffd5b88-f8f1-4430-b1f3-942f041bae30 10150 Maybe Security Update 3213631 https://www.microsoft.com/downloads/details.aspx?familyid=1488ace5-0972-4417-8595-42e723099054 3191844 10521 Maybe Security Update 3213631 https://www.microsoft.com/downloads/details.aspx?familyid=3b3f8ee8-acc8-42e9-baa8-560addd6e017 3191844 10522 Maybe Security Update 3213632 https://www.microsoft.com/downloads/details.aspx?familyid=4adf8370-4702-4957-9c56-0634f5f32dc1 3203466 10525 Maybe Security Update 4011125 https://www.microsoft.com/downloads/details.aspx?familyid=ad8c9a6a-e330-4dcb-955f-c15d345c1892 1160 Maybe Security Update 4025869 http://support.microsoft.com/kb/4025869 4020736 10956 Security Update 4011040 https://www.microsoft.com/downloads/details.aspx?familyid=f9b16fc9-d311-4e89-b8ca-1c8885488b06 3203382 10770 Maybe Security Update 4011040 https://www.microsoft.com/downloads/details.aspx?familyid=71a1182f-d498-45ca-a827-6aa17147f22d 3203382 10771 Maybe Security Update 4011040 https://www.microsoft.com/downloads/details.aspx?familyid=f9b16fc9-d311-4e89-b8ca-1c8885488b06 3203382 10772 Maybe Security Update 4011040 https://www.microsoft.com/downloads/details.aspx?familyid=71a1182f-d498-45ca-a827-6aa17147f22d 3203382 10773 Maybe Security Update 4025868 http://support.microsoft.com/kb/4025868 4020735 10290 Maybe Security Update 4025865 https://www.microsoft.com/downloads/details.aspx?familyid=f145b833-309f-49c6-b664-4155a216150d 4020732 10069 Maybe Security Update 4025865 https://www.microsoft.com/downloads/details.aspx?familyid=31ce5e7d-19cf-4838-9c30-791f4cdff4ce 4020732 10303 Maybe Security Update 4025866 https://www.microsoft.com/downloads/details.aspx?familyid=8e4ef5f4-f86d-4a70-b315-53d5eb596e1c 4020733 10268 Maybe Security Update 4025867 https://www.microsoft.com/downloads/details.aspx?familyid=76de234f-ebf5-4294-b6e2-577d7dcf9e3d 4020734 10295 Maybe Security Update 4011107 https://www.microsoft.com/downloads/details.aspx?familyid=34d3be9d-8fe2-4bac-a0a9-86d790b748fe 3191939 10628 Maybe Security Update 4011107 https://www.microsoft.com/downloads/details.aspx?familyid=e2465f08-7003-4c31-b390-ee0ad19f4b78 3191939 10630 Maybe Security Update 4011107 https://www.microsoft.com/downloads/details.aspx?familyid=34d3be9d-8fe2-4bac-a0a9-86d790b748fe 3191939 10629 Maybe Security Update 4011107 https://www.microsoft.com/downloads/details.aspx?familyid=e2465f08-7003-4c31-b390-ee0ad19f4b78 3191939 10631 Maybe Security Update Axel Souchet (<a href="https://twitter.com/0vercl0k">@0vercl0k</a>) of MSRC Vulnerabilities and Mitigations Team 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Shell Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists when Windows Shell does not properly validate file copy destinations.</p> <p>An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>To exploit the vulnerability, a user must open a specially crafted file. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and then convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force a user to visit the website. Instead, an attacker would have to convince a user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.</p> <p>The security update addresses the vulnerability by helping to ensure that Windows Shell validates file copy destinations.</p> Microsoft Windows CVE-2017-8699 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10051 10049 10378 10379 10483 10543 Remote Code Execution 10951 Remote Code Execution 10952 Remote Code Execution 10729 Remote Code Execution 10735 Remote Code Execution 10789 Remote Code Execution 10788 Remote Code Execution 10852 Remote Code Execution 10853 Remote Code Execution 10816 Remote Code Execution 10855 Remote Code Execution 10047 Remote Code Execution 10048 Remote Code Execution 10481 Remote Code Execution 10482 Remote Code Execution 10484 Remote Code Execution 9312 Remote Code Execution 10287 Remote Code Execution 9311 Remote Code Execution 9318 Remote Code Execution 9344 Remote Code Execution 10051 Remote Code Execution 10049 Remote Code Execution 10378 Remote Code Execution 10379 Remote Code Execution 10483 Remote Code Execution 10543 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10951 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10952 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10729 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10735 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10789 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10788 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10852 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10853 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10816 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10855 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10047 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10048 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10481 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10482 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10484 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 9312 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10287 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 9311 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 9318 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 9344 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10051 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10049 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10378 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10379 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10483 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C 10543 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4039266 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039266 4021903 9312 Yes Security Update 4039266 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039266 4021903 10287 Yes Security Update 4039266 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039266 4021903 9311 Yes Security Update 4039266 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039266 4021903 9318 Yes Security Update 4039266 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039266 4021903 9344 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only Pedro Gallegos of Microsoft Office Security Team 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Error Reporting Elevation of Privilege Vulnerability <p>An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it.</p> <p>An attacker who successfully exploited the vulnerability could gain greater access to sensitive information and system functionality. To exploit the vulnerability, an attacker could run a specially crafted application.</p> <p>The security update addresses the vulnerability by correcting the way that WER handles and executes files.</p> Microsoft Windows CVE-2017-8702 10729 10735 10789 10788 10852 10853 10816 10855 Elevation of Privilege 10729 Elevation of Privilege 10735 Elevation of Privilege 10789 Elevation of Privilege 10788 Elevation of Privilege 10852 Elevation of Privilege 10853 Elevation of Privilege 10816 Elevation of Privilege 10855 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A;Older Software Release:Exploitation Unlikely 7.5 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10729 7.5 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10735 7.5 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10789 7.5 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10788 7.5 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10852 7.5 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10853 7.5 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10816 7.5 6.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10855 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update Alex Ionescu, <a href="https://www.crowdstrike.com">CrowdStrike Inc.</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Hyper-V Denial of Service Vulnerability <p>A denial of service vulnerability exists when Microsoft Hyper-V Virtual PCI on a host server fails to properly validate input from a privileged user on a guest operating system. To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application that causes a host machine to crash.</p> <p>To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application.</p> <p>The security update addresses the vulnerability by properly validating input.</p> Windows Hyper-V CVE-2017-8704 10816 10855 10853 Denial of Service 10816 Denial of Service 10855 Denial of Service 10853 Important 10816 Important 10855 Important 10853 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation Unlikely 5.3 4.8 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C 10816 5.3 4.8 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C 10855 5.3 4.8 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C 10853 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update Jordan Rabet, Microsoft Offensive Security Research Team 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Hyper-V Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker on a guest operating system could run a specially crafted application that could cause the Hyper-V host operating system to disclose memory information.</p> <p>An attacker who successfully exploited the vulnerability could gain access to information on the Hyper-V host operating system.</p> <p>The security update addresses the vulnerability by correcting how Hyper-V validates guest operating system user input.</p> Windows Hyper-V CVE-2017-8706 10855 10735 10788 10853 10952 10816 Information Disclosure 10855 Information Disclosure 10735 Information Disclosure 10788 Information Disclosure 10853 Information Disclosure 10952 Information Disclosure 10816 Important 10855 Important 10735 Important 10788 Important 10853 Important 10952 Important 10816 Publicly Disclosed:No;Exploited:No 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10855 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10735 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10788 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10853 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10952 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10816 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update Nicolas Joly of MSRC Vulnerabilities & Mitigations 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Hyper-V Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker on a guest operating system could run a specially crafted application that could cause the Hyper-V host operating system to disclose memory information.</p> <p>An attacker who successfully exploited the vulnerability could gain access to information on the Hyper-V host operating system.</p> <p>The security update addresses the vulnerability by correcting how Hyper-V validates guest operating system user input.</p> Windows Hyper-V CVE-2017-8707 10735 10788 10853 9318 9344 10816 10855 10483 10543 10482 10051 10049 10378 10379 10952 Information Disclosure 10735 Information Disclosure 10788 Information Disclosure 10853 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10816 Information Disclosure 10855 Information Disclosure 10483 Information Disclosure 10543 Information Disclosure 10482 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10952 Important 10735 Important 10788 Important 10853 Important 9318 Important 9344 Important 10816 Important 10855 Important 10483 Important 10543 Important 10482 Important 10051 Important 10049 Important 10378 Important 10379 Important 10952 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10735 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10788 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10853 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 9318 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 9344 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10816 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10855 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10483 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10543 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10482 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10051 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10049 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10952 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4039325 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039325 9318 Yes Security Update 4039325 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039325 9344 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update Nicolas Joly of MSRC Vulnerabilities & Mitigations ZhenhaoHong of <a href="https://www.360.cn">Qihoo 360 Marvel Team</a> 1.1 2017-09-12T07:00:00Z <p>Added Windows Server 2012 and Windows Server 2012 (Server Core Installation) as affected by CVE-2017-8707. This is an informational change only.</p> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Kernel Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.</p> <p>The security update addresses the vulnerability by correcting how the Windows kernel initializes memory.</p> Windows Kernel CVE-2017-8708 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 Information Disclosure 10951 Information Disclosure 10952 Information Disclosure 10729 Information Disclosure 10735 Information Disclosure 10789 Information Disclosure 10788 Information Disclosure 10852 Information Disclosure 10853 Information Disclosure 10816 Information Disclosure 10855 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 10481 Information Disclosure 10482 Information Disclosure 10484 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10951 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10952 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10729 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10735 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10789 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10788 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10852 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10853 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10816 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10855 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10047 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10048 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10481 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10482 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10484 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9312 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10287 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9311 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9318 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9344 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10050 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10051 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10049 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10378 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10379 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10483 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10543 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 9312 Security Update 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 10287 Security Update 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 9311 Security Update 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 9318 Security Update 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only James Forshaw of <a href="https://www.google.com/">Google Project Zero</a> 1.1 2017-09-12T07:00:00Z <p>Updated acknowledgment. This is an informational change only.</p> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Kernel Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.</p> <p>The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.</p> Windows Kernel CVE-2017-8709 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 Information Disclosure 10951 Information Disclosure 10952 Information Disclosure 10729 Information Disclosure 10735 Information Disclosure 10789 Information Disclosure 10788 Information Disclosure 10852 Information Disclosure 10853 Information Disclosure 10816 Information Disclosure 10855 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 10481 Information Disclosure 10482 Information Disclosure 10484 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10951 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10952 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10729 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10735 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10789 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10788 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10852 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10853 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10816 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10855 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10047 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10048 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10481 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10482 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10484 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9312 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10287 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9311 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9318 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9344 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10050 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10051 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10049 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10378 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10379 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10483 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10543 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4032201 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4032201 9312 Yes Security Update 4032201 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4032201 10287 Yes Security Update 4032201 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4032201 9311 Yes Security Update 4032201 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4032201 9318 Yes Security Update 4032201 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4032201 9344 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only <a href="https://twitter.com/TinySecEx">fanxiaocao</a> and <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab , <a href="https://www.360.com/">Qihoo 360</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows System Information Console Information Disclosure Vulnerability <p>An information disclosure vulnerability exists in the Microsoft Common Console Document (.msc) when it improperly parses XML input containing a reference to an external entity. An attacker who successfully exploited this vulnerability could read arbitrary files via an XML external entity (XXE) declaration.</p> <p>To exploit the vulnerability, an attacker could create a file containing specially crafted XML content and convince an authenticated user to open the file.</p> <p>The update addresses the vulnerability by modifying the way that the Microsoft Common Console Document (.msc) parses XML input.</p> Microsoft Windows CVE-2017-8710 9344 10050 10051 10049 10047 10048 9312 10287 9311 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10047 Information Disclosure 10048 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10047 Important 10048 Important 9312 Important 10287 Important 9311 Important 9318 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 4.4 4.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9344 4.4 4.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10050 4.4 4.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10051 4.4 4.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10049 4.4 4.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10047 4.4 4.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10048 4.4 4.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9312 4.4 4.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10287 4.4 4.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9311 4.4 4.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9318 4039038 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039038 9344 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4039038 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039038 9312 Yes Security Update 4039038 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039038 10287 Yes Security Update 4039038 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039038 9311 Yes Security Update 4039038 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039038 9318 Yes Security Update SaifAllah benMassaoud (<a href="https://twitter.com/benmassaou">@benmassaou</a>) <a href="http://hyp3rlinx.altervista.org">John Page aka hyp3rlinx</a> of Apparition Security 1.1 2017-09-12T07:00:00Z <p>Corrected the affected Windows component in the CVE description. This is an informational change only.</p> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> 1.2 2019-12-04T08:00:00Z <p>Added an acknowledgement.</p> Windows Hyper-V Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker on a guest operating system could run a specially crafted application that could cause the Hyper-V host operating system to disclose memory information.</p> <p>An attacker who successfully exploited the vulnerability could gain access to information on the Hyper-V host operating system.</p> <p>The security update addresses the vulnerability by correcting how Hyper-V validates guest operating system user input.</p> Windows Hyper-V CVE-2017-8711 10816 10855 10853 Information Disclosure 10816 Information Disclosure 10855 Information Disclosure 10853 Important 10816 Important 10855 Important 10853 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10816 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10855 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10853 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update Jordan Rabet, Microsoft Offensive Security Research Team 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Hyper-V Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker on a guest operating system could run a specially crafted application that could cause the Hyper-V host operating system to disclose memory information.</p> <p>An attacker who successfully exploited the vulnerability could gain access to information on the Hyper-V host operating system.</p> <p>The security update addresses the vulnerability by correcting how Hyper-V validates guest operating system user input.</p> Windows Hyper-V CVE-2017-8712 10952 10816 10853 10855 Information Disclosure 10952 Information Disclosure 10816 Information Disclosure 10853 Information Disclosure 10855 Important 10952 Important 10816 Important 10853 Important 10855 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10952 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10816 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10853 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10855 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update Windows & Devices Group - Operating System Security Team 1.1 2017-09-13T07:00:00Z <p>Updated acknowledgment.</p> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Hyper-V Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker on a guest operating system could run a specially crafted application that could cause the Hyper-V host operating system to disclose memory information.</p> <p>An attacker who successfully exploited the vulnerability could gain access to information on the Hyper-V host operating system.</p> <p>The security update addresses the vulnerability by correcting how Hyper-V validates guest operating system user input.</p> Windows Hyper-V CVE-2017-8713 10952 10816 10735 10788 10853 10482 10378 10379 10483 10543 10855 Information Disclosure 10952 Information Disclosure 10816 Information Disclosure 10735 Information Disclosure 10788 Information Disclosure 10853 Information Disclosure 10482 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Information Disclosure 10855 Important 10952 Important 10816 Important 10735 Important 10788 Important 10853 Important 10482 Important 10378 Important 10379 Important 10483 Important 10543 Important 10855 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10952 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10816 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10735 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10788 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10853 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10482 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10378 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10379 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10483 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10543 7.2 6.5 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C 10855 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update Joe Bialek, MSRC Vulnerabilities and Mitigations Team 1.1 2017-09-13T07:00:00Z <p>Updated acknowledgment.</p> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Remote Desktop Virtual Host Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists in the VM Host Agent Service of Remote Desktop Virtual Host role when it fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could issue a specially crafted certificate on the guest operating system that could cause the VM host agent service on the host operating system to execute arbitrary code. The Remote Desktop Virtual Host role is not enabled by default.</p> <p>An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system.</p> <p>The security update addresses the vulnerability by correcting how VM host agent service validates guest operating system user input.</p> Windows Hyper-V CVE-2017-8714 10853 10816 10855 10482 10378 10379 10483 10543 Remote Code Execution 10853 Remote Code Execution 10816 Remote Code Execution 10855 Remote Code Execution 10482 Remote Code Execution 10378 Remote Code Execution 10379 Remote Code Execution 10483 Remote Code Execution 10543 Important 10853 Important 10816 Important 10855 Important 10482 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A 7.8 7.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10853 7.8 7.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10816 7.8 7.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10855 7.8 7.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10482 7.8 7.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10378 7.8 7.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10379 7.8 7.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10483 7.8 7.0 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C 10543 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only <a href="https://twitter.com/jsc29a">Jared S. Candelaria</a> 1.1 2017-09-12T07:00:00Z <p>Removed Windows 10 for x64-based Systems as affected by CVE-2017-8714. This is an informational change only.</p> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Security Feature Bypass Vulnerability <p>A security feature bypass vulnerability exists when Windows Control Flow Guard mishandles objects in memory.</p> <p>To exploit the vulnerability, an attacker could run a specially crafted application to bypass Control Flow Guard.</p> <p>The security update addresses the vulnerability by correcting how Windows Control Flow Guard handles objects in memory.</p> Microsoft Windows CVE-2017-8716 10951 10952 Security Feature Bypass 10951 Security Feature Bypass 10952 Important 10951 Important 10952 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:N/A;DOS:N/A 4.9 4.4 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10951 4.9 4.4 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10952 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update Zhang Yunhai of <a href="http://www.nsfocus.com/">NSFOCUS</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows Kernel Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user’s system.</p> <p>To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to execute code or to elevate user rights directly, but it could be used to obtain information that could be used to try to further compromise the affected system.</p> <p>The update addresses the vulnerability by correcting how the Windows kernel handles objects in memory.</p> Windows Kernel CVE-2017-8719 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 Information Disclosure 10951 Information Disclosure 10952 Information Disclosure 10729 Information Disclosure 10735 Information Disclosure 10789 Information Disclosure 10788 Information Disclosure 10852 Information Disclosure 10853 Information Disclosure 10816 Information Disclosure 10855 Information Disclosure 10481 Information Disclosure 10482 Information Disclosure 10484 Information Disclosure 9312 Information Disclosure 10287 Information Disclosure 9311 Information Disclosure 9318 Information Disclosure 9344 Information Disclosure 10050 Information Disclosure 10051 Information Disclosure 10049 Information Disclosure 10378 Information Disclosure 10379 Information Disclosure 10483 Information Disclosure 10543 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10951 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10952 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10729 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10735 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10789 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10788 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10852 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10853 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10816 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10855 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10481 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10482 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10484 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9312 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10287 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9311 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9318 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 9344 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10050 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10051 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10049 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10378 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10379 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10483 4.7 4.2 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C 10543 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 9312 Security Update 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 10287 Security Update 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 9311 Security Update 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 9318 Security Update 4038874 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038874 4022013 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only <a href="https://twitter.com/TinySecEx">fanxiaocao</a> and <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab , <a href="https://www.360.com/">Qihoo 360</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Win32k Elevation of Privilege Vulnerability <p>An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.</p> <p>The update addresses this vulnerability by correcting how Win32k handles objects in memory.</p> Microsoft Graphics Component CVE-2017-8720 10951 10952 10729 10735 10789 10788 10852 10853 10816 10855 10047 10048 10481 10482 10484 9312 10287 9311 9318 9344 10050 10051 10049 10378 10379 10483 10543 Elevation of Privilege 10951 Elevation of Privilege 10952 Elevation of Privilege 10729 Elevation of Privilege 10735 Elevation of Privilege 10789 Elevation of Privilege 10788 Elevation of Privilege 10852 Elevation of Privilege 10853 Elevation of Privilege 10816 Elevation of Privilege 10855 Elevation of Privilege 10047 Elevation of Privilege 10048 Elevation of Privilege 10481 Elevation of Privilege 10482 Elevation of Privilege 10484 Elevation of Privilege 9312 Elevation of Privilege 10287 Elevation of Privilege 9311 Elevation of Privilege 9318 Elevation of Privilege 9344 Elevation of Privilege 10050 Elevation of Privilege 10051 Elevation of Privilege 10049 Elevation of Privilege 10378 Elevation of Privilege 10379 Elevation of Privilege 10483 Elevation of Privilege 10543 Important 10951 Important 10952 Important 10729 Important 10735 Important 10789 Important 10788 Important 10852 Important 10853 Important 10816 Important 10855 Important 10047 Important 10048 Important 10481 Important 10482 Important 10484 Important 9312 Important 10287 Important 9311 Important 9318 Important 9344 Important 10050 Important 10051 Important 10049 Important 10378 Important 10379 Important 10483 Important 10543 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10951 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10952 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10729 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10735 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10789 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10788 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10852 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10853 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10816 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10855 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10047 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10048 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10481 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10482 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10484 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 9312 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10287 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 9311 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 9318 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 9344 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10050 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10051 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10049 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10483 7.8 7.0 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10543 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10047 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10047 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10048 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10048 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9312 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 10287 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9311 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9318 Security Update 4039384 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4039384 4022887 9344 Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10050 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10050 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10051 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10051 Yes Security Only 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10049 Yes Monthly Rollup 4038779 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038779 10049 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only Jaanus Kp of Clarified Security working with <a href="http://www.zerodayinitiative.com/">Trend Micro's Zero Day Initiative</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Edge Security Feature Bypass Vulnerability <p>A security feature bypass vulnerability exists in Microsoft Edge when the Edge <a href="https://technet.microsoft.com/en-us/library/security/dn848375.aspx#CSP">Content Security Policy (CSP)</a> fails to properly validate certain specially crafted documents. An attacker who exploited the bypass could trick a user into loading a page containing malicious content.</p> <p>To exploit the bypass, an attacker must trick a user into either loading a page containing malicious content or visiting a malicious website. The attacker could also inject the malicious page into either a compromised website or an advertisement network.</p> <p>The security update addresses the bypass by correcting how the Edge CSP validates documents.</p> Microsoft Edge CVE-2017-8723 10724-10816 10724-10951 10724-10952 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 Security Feature Bypass 10724-10816 Security Feature Bypass 10724-10951 Security Feature Bypass 10724-10952 Security Feature Bypass 10724-10729 Security Feature Bypass 10724-10735 Security Feature Bypass 10724-10789 Security Feature Bypass 10724-10788 Security Feature Bypass 10724-10852 Security Feature Bypass 10724-10853 Low 10724-10816 Moderate 10724-10951 Moderate 10724-10952 Moderate 10724-10729 Moderate 10724-10735 Moderate 10724-10789 Moderate 10724-10788 Moderate 10724-10852 Moderate 10724-10853 Publicly Disclosed:Yes;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:N/A 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10816 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10951 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10952 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10729 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10735 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10789 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10788 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10852 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10853 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update Jun Kokatsu (<a href="https://twitter.com/shhnjk/">@shhnjk</a>) 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Edge Spoofing Vulnerability <p>A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could trick a user by redirecting the user to a specially crafted website. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services.</p> <p>To exploit the vulnerability, the user must click a specially crafted URL. In an email attack scenario, an attacker could send an email message containing the specially crafted URL to the user in an attempt to convince the user to click it.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website designed to appear as a legitimate website to the user. However, the attacker would have no way to force the user to visit the specially crafted website. The attacker would have to convince the user to visit the specially crafted website, typically by way of enticement in an email or instant message, and then convince the user to interact with content on the website.</p> <p>The update addresses the vulnerability by correcting how Microsoft Edge parses HTTP responses.</p> Microsoft Edge CVE-2017-8724 10724-10951 10724-10952 Spoofing 10724-10951 Spoofing 10724-10952 Important 10724-10951 Important 10724-10952 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:N/A 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update Jun Kokatsu (<a href="https://twitter.com/shhnjk/">@shhnjk</a>) 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Windows PDF Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists when Microsoft Windows PDF Library improperly handles objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>To exploit the vulnerability on Windows 10 systems with Microsoft Edge set as the default browser, an attacker could host a specially crafted website that contains malicious PDF content and then convince users to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted PDF content to such sites. Only Windows 10 systems with Microsoft Edge set as the default browser can be compromised simply by viewing a website. The browsers for all other affected operating systems do not automatically render PDF content, so an attacker would have no way to force users to view attacker-controlled content. Instead, an attacker would have to convince users to open a specially crafted PDF document, typically by way of an enticement in an email or instant message or by way of an email attachment.</p> <p>The update addresses the vulnerability by modifying how affected systems handle objects in memory.</p> Microsoft Windows PDF CVE-2017-8728 10481 10482 10484 10378 10379 10483 10543 10724-10951 10724-10952 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 Remote Code Execution 10481 Remote Code Execution 10482 Remote Code Execution 10484 Remote Code Execution 10378 Remote Code Execution 10379 Remote Code Execution 10483 Remote Code Execution 10543 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Remote Code Execution 10724-10729 Remote Code Execution 10724-10735 Remote Code Execution 10724-10789 Remote Code Execution 10724-10788 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Critical 10481 Critical 10482 Critical 10484 Critical 10378 Critical 10379 Critical 10483 Critical 10543 Critical 10724-10951 Critical 10724-10952 Critical 10724-10729 Critical 10724-10735 Critical 10724-10789 Critical 10724-10788 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10481 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10482 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10484 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10378 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10379 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10483 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10543 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10729 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10735 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10481 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10481 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10482 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10482 Yes Security Only 4038792 4034681 10484 Yes Monthly Rollup 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10378 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10378 Yes Security Only 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10379 Yes Monthly Rollup 4038786 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038786 10379 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10483 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10483 Yes Security Only 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10543 Yes Monthly Rollup 4038793 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038793 10543 Yes Security Only 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update Giwan Go of STEALIEN & HIT working with <a href="http://www.zerodayinitiative.com/">Trend Micro's Zero Day Initiative</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> 1.1 2017-09-14T07:00:00Z <p>Updated exploitability assessment for Older Software Release. This is an informational change only.</p> Scripting Engine Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p> <p>The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.</p> Microsoft Scripting Engine CVE-2017-8729 10724-10951 10724-10952 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Critical 10724-10951 Critical 10724-10952 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update Lokihardt of <a href="https://www.google.com/">Google Project Zero</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Edge Memory Corruption Vulnerability <p>A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by way of enticement in an email or Instant Messenger message, or by getting them to open an attachment sent through email.</p> <p>The security update addresses the vulnerability by modifying how Microsoft Edge handles objects in memory.</p> Microsoft Edge CVE-2017-8731 10724-10852 10724-10853 10724-10816 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update Ivan Fratric of <a href="https://www.google.com/">Google Project Zero</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Internet Explorer Spoofing Vulnerability <p>A spoofing vulnerability exists when Internet Explorer improperly handles specific HTML content. An attacker who successfully exploited this vulnerability could trick a user into believing that the user was visiting a legitimate website. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services.</p> <p>To exploit the vulnerability, the user must either browse to a malicious website or be redirected to it. In an email attack scenario, an attacker could send an email message in an attempt to convince the user to click a link to the malicious website.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website designed to appear as a legitimate website to the user. However, the attacker would have no way to force the user to visit the specially crafted website. The attacker would have to convince the user to visit the specially crafted website, typically by way of enticement in an email or instant message.</p> <p>The security update addresses the vulnerability by correcting how Internet Explorer handles specific HTML content.</p> Internet Explorer CVE-2017-8733 10555-10378 10336-9312 10336-9318 10486-10951 10486-10952 10486-10729 10486-10735 10486-10789 10486-10788 10486-10852 10486-10853 10486-10816 10486-10047 10486-10048 10486-10481 10486-10482 10486-10484 10486-10051 10486-10483 Spoofing 10555-10378 Spoofing 10336-9312 Spoofing 10336-9318 Spoofing 10486-10951 Spoofing 10486-10952 Spoofing 10486-10729 Spoofing 10486-10735 Spoofing 10486-10789 Spoofing 10486-10788 Spoofing 10486-10852 Spoofing 10486-10853 Spoofing 10486-10816 Spoofing 10486-10047 Spoofing 10486-10048 Spoofing 10486-10481 Spoofing 10486-10482 Spoofing 10486-10484 Spoofing 10486-10051 Spoofing 10486-10483 Low 10555-10378 Low 10336-9312 Low 10336-9318 Important 10486-10951 Important 10486-10952 Important 10486-10729 Important 10486-10735 Important 10486-10789 Important 10486-10788 Important 10486-10852 Important 10486-10853 Low 10486-10816 Important 10486-10047 Important 10486-10048 Important 10486-10481 Important 10486-10482 Important 10486-10484 Low 10486-10051 Low 10486-10483 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation Unlikely 2.4 2.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10555-10378 2.4 2.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10336-9312 2.4 2.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10336-9318 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10951 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10952 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10729 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10735 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10789 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10788 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10852 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10853 2.4 2.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10816 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10047 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10048 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10481 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10482 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10484 2.4 2.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10051 2.4 2.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10486-10483 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10555-10378 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10555-10378 Yes IE Cumulative 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10336-9312 Yes IE Cumulative 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10336-9318 Yes IE Cumulative 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10486-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10486-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10486-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10486-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10486-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10486-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10816 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10047 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10047 Yes IE Cumulative 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10048 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10048 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10481 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10481 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10482 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10482 Yes IE Cumulative 4038792 4034681 10486-10484 Yes Monthly Rollup 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10051 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10051 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10483 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10483 Yes IE Cumulative Masato Kinugawa of <a href="https://cure53.de/">Cure53</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Edge Memory Corruption Vulnerability <p>A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by way of enticement in an email or Instant Messenger message, or by getting them to open an attachment sent through email.</p> <p>The security update addresses the vulnerability by modifying how Microsoft Edge handles objects in memory.</p> Microsoft Edge CVE-2017-8734 10724-10951 10724-10952 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Remote Code Execution 10724-10729 Remote Code Execution 10724-10735 Remote Code Execution 10724-10789 Remote Code Execution 10724-10788 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Critical 10724-10951 Critical 10724-10952 Critical 10724-10729 Critical 10724-10735 Critical 10724-10789 Critical 10724-10788 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10729 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10735 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update Ivan Fratric of <a href="https://www.google.com/">Google Project Zero</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Browser Information Disclosure Vulnerability <p>An information disclosure vulnerability exists in Microsoft browsers due to improper parent domain verification in certain functionality. An attacker who successfully exploited the vulnerability could obtain specific information that is used in the parent domain.</p> <p>To exploit the vulnerability, an attacker must have access to host malicious content on a website this is on a subdomain of the parent domain, and then convince a user to visit the site.</p> <p>The security update addresses the vulnerability by helping to ensure that Microsoft browsers restrict access to certain functionality between the subdomain and the parent domain.</p> Microsoft Browsers CVE-2017-8736 10724-10816 10724-10951 10724-10952 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 10486-10951 10486-10952 10486-10729 10486-10735 10486-10789 10486-10788 10486-10852 10486-10853 10486-10816 10486-10047 10486-10048 10486-10481 10486-10482 10486-10484 10486-10051 10486-10483 Information Disclosure 10724-10816 Information Disclosure 10724-10951 Information Disclosure 10724-10952 Information Disclosure 10724-10729 Information Disclosure 10724-10735 Information Disclosure 10724-10789 Information Disclosure 10724-10788 Information Disclosure 10724-10852 Information Disclosure 10724-10853 Information Disclosure 10486-10951 Information Disclosure 10486-10952 Information Disclosure 10486-10729 Information Disclosure 10486-10735 Information Disclosure 10486-10789 Information Disclosure 10486-10788 Information Disclosure 10486-10852 Information Disclosure 10486-10853 Information Disclosure 10486-10816 Information Disclosure 10486-10047 Information Disclosure 10486-10048 Information Disclosure 10486-10481 Information Disclosure 10486-10482 Information Disclosure 10486-10484 Information Disclosure 10486-10051 Information Disclosure 10486-10483 Low 10724-10816 Important 10724-10951 Important 10724-10952 Important 10724-10729 Important 10724-10735 Important 10724-10789 Important 10724-10788 Important 10724-10852 Important 10724-10853 Important 10486-10951 Important 10486-10952 Important 10486-10729 Important 10486-10735 Important 10486-10789 Important 10486-10788 Important 10486-10852 Important 10486-10853 Low 10486-10816 Important 10486-10047 Important 10486-10048 Important 10486-10481 Important 10486-10482 Important 10486-10484 Low 10486-10051 Low 10486-10483 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:N/A 2.4 2.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10816 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10951 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10952 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10729 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10735 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10789 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10788 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10852 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10853 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10951 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10952 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10729 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10735 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10789 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10788 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10852 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10853 2.4 2.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10816 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10047 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10048 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10481 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10482 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10484 2.4 2.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10051 2.4 2.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10486-10483 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10486-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10486-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10486-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10486-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10486-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10486-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10816 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10047 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10047 Yes IE Cumulative 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10048 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10048 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10481 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10481 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10482 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10482 Yes IE Cumulative 4038792 4034681 10486-10484 Yes Monthly Rollup 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10051 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10051 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10483 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10483 Yes IE Cumulative Jun Kokatsu (<a href="https://twitter.com/shhnjk/">@shhnjk</a>) 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Scripting Engine Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p> <p>The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.</p> Microsoft Scripting Engine CVE-2017-8738 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 Remote Code Execution 10724-10729 Remote Code Execution 10724-10735 Remote Code Execution 10724-10789 Remote Code Execution 10724-10788 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Critical 10724-10729 Critical 10724-10735 Critical 10724-10789 Critical 10724-10788 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10729 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10735 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update Anonymous working with <a href="http://www.zerodayinitiative.com/">Trend Micro's Zero Day Initiative</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Scripting Engine Information Disclosure Vulnerability <p>An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.</p> <p>In a web-based attack scenario, an attacker could host a website in an attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could trick a user into clicking a link that takes the user to the attacker's site.</p> <p>The security update addresses the vulnerability by changing how the scripting engine handles objects in memory.</p> Microsoft Scripting Engine CVE-2017-8739 10724-10951 10724-10952 Information Disclosure 10724-10951 Information Disclosure 10724-10952 Important 10724-10951 Important 10724-10952 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:N/A 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10951 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C 10724-10952 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update Microsoft ChakraCore Team 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Scripting Engine Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p> <p>The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.</p> Microsoft Scripting Engine CVE-2017-8740 10724-10951 10724-10952 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Critical 10724-10951 Critical 10724-10952 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update Lokihardt of <a href="https://www.google.com/">Google Project Zero</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Scripting Engine Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in the way that Microsoft browser JavaScript engines render content when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers and then convince a user to view the website. An attacker could also embed an ActiveX control marked &quot;safe for initialization&quot; in an application or Microsoft Office document that hosts the related rendering engine. The attacker could also take advantage of compromised websites, and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p> <p>An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>The security update addresses the vulnerability by modifying how Microsoft browser JavaScript scripting engines handle objects in memory.</p> Microsoft Scripting Engine CVE-2017-8741 10724-10951 10724-10952 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 10555-10378 10336-9312 10336-9318 10486-10951 10486-10952 10486-10729 10486-10735 10486-10789 10486-10788 10486-10852 10486-10853 10486-10816 10486-10047 10486-10048 10486-10481 10486-10482 10486-10484 10486-10051 10486-10483 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Remote Code Execution 10724-10729 Remote Code Execution 10724-10735 Remote Code Execution 10724-10789 Remote Code Execution 10724-10788 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Remote Code Execution 10555-10378 Remote Code Execution 10336-9312 Remote Code Execution 10336-9318 Remote Code Execution 10486-10951 Remote Code Execution 10486-10952 Remote Code Execution 10486-10729 Remote Code Execution 10486-10735 Remote Code Execution 10486-10789 Remote Code Execution 10486-10788 Remote Code Execution 10486-10852 Remote Code Execution 10486-10853 Remote Code Execution 10486-10816 Remote Code Execution 10486-10047 Remote Code Execution 10486-10048 Remote Code Execution 10486-10481 Remote Code Execution 10486-10482 Remote Code Execution 10486-10484 Remote Code Execution 10486-10051 Remote Code Execution 10486-10483 Critical 10724-10951 Critical 10724-10952 Critical 10724-10729 Critical 10724-10735 Critical 10724-10789 Critical 10724-10788 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Moderate 10555-10378 Moderate 10336-9312 Moderate 10336-9318 Critical 10486-10951 Critical 10486-10952 Critical 10486-10729 Critical 10486-10735 Critical 10486-10789 Critical 10486-10788 Critical 10486-10852 Critical 10486-10853 Moderate 10486-10816 Critical 10486-10047 Critical 10486-10048 Critical 10486-10481 Critical 10486-10482 Critical 10486-10484 Moderate 10486-10051 Moderate 10486-10483 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10729 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10735 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10555-10378 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10336-9312 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10336-9318 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10729 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10735 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10853 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10816 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10047 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10048 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10481 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10482 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10484 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10051 3.1 2.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10486-10483 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10555-10378 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10555-10378 Yes IE Cumulative 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10336-9312 Yes IE Cumulative 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10336-9318 Yes IE Cumulative 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10486-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10486-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10486-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10486-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10486-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10486-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10816 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10047 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10047 Yes IE Cumulative 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10048 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10048 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10481 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10481 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10482 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10482 Yes IE Cumulative 4038792 4034681 10486-10484 Yes Monthly Rollup 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10051 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10051 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10483 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10483 Yes IE Cumulative Microsoft ChakraCore Team 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft PowerPoint Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office PowerPoint software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.</p> <p>Note that the Preview Pane is not an attack vector for this vulnerability. The security update addresses the vulnerability by correcting how Microsoft PowerPoint handles objects in memory.</p> Microsoft Office CVE-2017-8742 10611 10607 10950 10692 10693 10694 10741 10742 10157 10498 10499 10525 4497 11452 Remote Code Execution 10611 Remote Code Execution 10607 Remote Code Execution 10950 Remote Code Execution 10692 Remote Code Execution 10693 Remote Code Execution 10694 Remote Code Execution 10741 Remote Code Execution 10742 Remote Code Execution 10157 Remote Code Execution 10498 Remote Code Execution 10499 Remote Code Execution 10525 Remote Code Execution 4497 Remote Code Execution 11452 Important 10611 Important 10607 Important 10950 Important 10692 Important 10693 Important 10694 Important 10741 Important 10742 Important 10157 Important 10498 Important 10499 Important 10525 Important 4497 Important 11452 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely 3213562 https://www.microsoft.com/downloads/details.aspx?familyid=2148c1a7-92ae-481b-9305-a9f2231ec46e 10611 Maybe Security Update 3213560 https://www.microsoft.com/downloads/details.aspx?familyid=42f5a2bd-7fb7-48af-8021-c0c9d67c2346 10607 Maybe Security Update 4011127 https://www.microsoft.com/downloads/details.aspx?familyid=4df75d92-55d6-45d9-ac16-7aa923a0bb44 3213544 10950 Security Update 4011069 https://www.microsoft.com/downloads/details.aspx?familyid=508e42ba-23dd-42f6-9662-0c01138dd49d 3115487 10692 Maybe Security Update 4011069 https://www.microsoft.com/downloads/details.aspx?familyid=d3d70de0-1f92-4763-a813-3a9af9f2fdb5 3115487 10693 Maybe Security Update 4011069 3115487 10694 Maybe Security Update 4011041 https://www.microsoft.com/downloads/details.aspx?familyid=4934a0db-f0a7-48cd-a6a6-9d2899a0494b 3114518 10741 Maybe Security Update 4011041 https://www.microsoft.com/downloads/details.aspx?familyid=52d9987c-046e-4011-838b-0f869b22239f 3114518 10742 Maybe Security Update 3213642 https://www.microsoft.com/downloads/details.aspx?familyid=882e52e4-027f-42a8-b7e7-ec067d4917f3 10157 Maybe Security Update 3128027 https://www.microsoft.com/downloads/details.aspx?familyid=f25ac533-d635-4031-918c-a95d3e53700c 3118378 10498 Maybe Security Update 3128027 https://www.microsoft.com/downloads/details.aspx?familyid=a49930fa-9bfa-41b4-94bf-1c1f098f8167 3118378 10499 Maybe Security Update 3213632 https://www.microsoft.com/downloads/details.aspx?familyid=4adf8370-4702-4957-9c56-0634f5f32dc1 3203466 10525 Maybe Security Update 3213644 https://www.microsoft.com/downloads/details.aspx?familyid=5628668a-d63b-454c-b2a3-6bbf3a5b0893 4497 Maybe Security Update 3128030 https://www.microsoft.com/downloads/details.aspx?familyid=6955027a-c34c-4d43-ac0b-37f01da97164 3118382 11452 Maybe Security Update Minh Tran<br><a href="http://blog.fortinet.com/"><i>Fortinet's FortiGuard Labs</i></a> 1.1 2017-09-15T07:00:00Z <p>Corrected the Product to which update 3128030 applies in the Affected Products table. Microsoft recommends that customers running PowerPoint Viewer 2010 who have not already installed the update should do so to be protected from the vulnerability. Customers who have already successfully installed the update do not need to take any further action.</p> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft PowerPoint Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office PowerPoint software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.</p> <p>Note that the Preview Pane is not an attack vector for this vulnerability. The security update addresses the vulnerability by correcting how Microsoft PowerPoint handles objects in memory.</p> Microsoft Office CVE-2017-8743 10741 10742 10950 10836 Remote Code Execution 10741 Remote Code Execution 10742 Remote Code Execution 10950 Remote Code Execution 10836 Important 10741 Important 10742 Important 10950 Important 10836 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely 4011041 https://www.microsoft.com/downloads/details.aspx?familyid=4934a0db-f0a7-48cd-a6a6-9d2899a0494b 3114518 10741 Maybe Security Update 4011041 https://www.microsoft.com/downloads/details.aspx?familyid=52d9987c-046e-4011-838b-0f869b22239f 3114518 10742 Maybe Security Update 4011127 https://www.microsoft.com/downloads/details.aspx?familyid=4df75d92-55d6-45d9-ac16-7aa923a0bb44 3213544 10950 Security Update 3213658 https://www.microsoft.com/downloads/details.aspx?familyid=8b961b52-24b9-4ced-99fa-b8e19d397c9e 10836 Maybe Security Update Jaanus Kp Clarified Security working with <a href="http://www.zerodayinitiative.com/">Trend Micro's Zero Day Initiative</a>Initiative 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Publisher Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists in Microsoft Publisher software when it fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could use a specially crafted file to perform actions in the security context of the current user. For example, the file could then take actions on behalf of the logged-on user with the same permissions as the current user.</p> <p>To exploit the vulnerability, a user must open a specially crafted file with an affected version of Microsoft Office software. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file. In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Publisher handles files in memory.</p> Microsoft Office CVE-2017-8725 10159 10503 10504 Remote Code Execution 10159 Remote Code Execution 10503 Remote Code Execution 10504 Important 10159 Important 10503 Important 10504 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 3114428 https://www.microsoft.com/downloads/details.aspx?familyid=545c3eb7-5102-4bfa-b071-430fd75a8a65 10159 Maybe Security Update 3141537 https://www.microsoft.com/downloads/details.aspx?familyid=01d81b57-8dcd-4e8f-9432-b87b8c529e63 3114395 10503 Maybe Security Update 3141537 https://www.microsoft.com/downloads/details.aspx?familyid=66326f51-efdc-4db7-8660-3e41c7697b89 3114395 10504 Maybe Security Update Phil Blankenship<br><a href="https://www.cerberussec.org"><i>Cerberus Security</i></a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Edge Spoofing Vulnerability <p>A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could trick a user by redirecting the user to a specially crafted website. The specially crafted website could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services.</p> <p>To exploit the vulnerability, the user must click a specially crafted URL. In an email attack scenario, an attacker could send an email message containing the specially crafted URL to the user in an attempt to convince the user to click it.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website designed to appear as a legitimate website to the user. However, the attacker would have no way to force the user to visit the specially crafted website. The attacker would have to convince the user to visit the specially crafted website, typically by way of enticement in an email or instant message, and then convince the user to interact with content on the website.</p> <p>The update addresses the vulnerability by correcting how Microsoft Edge parses HTTP responses.</p> Microsoft Edge CVE-2017-8735 10724-10951 10724-10952 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 Spoofing 10724-10951 Spoofing 10724-10952 Spoofing 10724-10729 Spoofing 10724-10735 Spoofing 10724-10789 Spoofing 10724-10788 Spoofing 10724-10852 Spoofing 10724-10853 Spoofing 10724-10816 Moderate 10724-10951 Moderate 10724-10952 Moderate 10724-10729 Moderate 10724-10735 Moderate 10724-10789 Moderate 10724-10788 Moderate 10724-10852 Moderate 10724-10853 Low 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:N/A 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10724-10729 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10724-10735 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.3 3.9 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10724-10853 2.4 2.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Device Guard Code Integrity Policy Security Feature Bypass Vulnerability <p>A security feature bypass vulnerability exists in Device Guard that could allow an attacker to inject malicious code into a Windows PowerShell session. An attacker who successfully exploited this vulnerability could inject code into a trusted PowerShell process to bypass the Device Guard Code Integrity policy on the local machine.</p> <p>To exploit the vulnerability, an attacker would first have to access the local machine, and then inject malicious code into a script that is trusted by the Code Integrity policy. The injected code would then run with the same trust level as the script and bypass the Code Integrity policy.</p> <p>The update addresses the vulnerability by correcting how PowerShell exposes functions and processes user supplied code.</p> Device Guard CVE-2017-8746 10951 10952 10852 10853 10816 10855 Security Feature Bypass 10951 Security Feature Bypass 10952 Security Feature Bypass 10852 Security Feature Bypass 10853 Security Feature Bypass 10816 Security Feature Bypass 10855 Important 10951 Important 10952 Important 10852 Important 10853 Important 10816 Important 10855 Publicly Disclosed:Yes;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely 5.3 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10951 5.3 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10952 5.3 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10852 5.3 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10853 5.3 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10816 5.3 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C 10855 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10952 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10855 Yes Security Update 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Internet Explorer Memory Corruption Vulnerability <p>A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action, typically by an enticement in an email or instant message, or by getting the user to open an attachment sent through email.</p> <p>The security update addresses the vulnerability by modifying how Internet Explorer handles objects in memory.</p> Internet Explorer CVE-2017-8747 10555-10378 10486-10951 10486-10952 10486-10729 10486-10735 10486-10789 10486-10788 10486-10852 10486-10853 10486-10816 10486-10047 10486-10048 10486-10481 10486-10482 10486-10484 10486-10051 10486-10483 Remote Code Execution 10555-10378 Remote Code Execution 10486-10951 Remote Code Execution 10486-10952 Remote Code Execution 10486-10729 Remote Code Execution 10486-10735 Remote Code Execution 10486-10789 Remote Code Execution 10486-10788 Remote Code Execution 10486-10852 Remote Code Execution 10486-10853 Remote Code Execution 10486-10816 Remote Code Execution 10486-10047 Remote Code Execution 10486-10048 Remote Code Execution 10486-10481 Remote Code Execution 10486-10482 Remote Code Execution 10486-10484 Remote Code Execution 10486-10051 Remote Code Execution 10486-10483 Moderate 10555-10378 Critical 10486-10951 Critical 10486-10952 Critical 10486-10729 Critical 10486-10735 Critical 10486-10789 Critical 10486-10788 Critical 10486-10852 Critical 10486-10853 Moderate 10486-10816 Critical 10486-10047 Critical 10486-10048 Critical 10486-10481 Critical 10486-10482 Critical 10486-10484 Moderate 10486-10051 Moderate 10486-10483 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10555-10378 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10951 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10952 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10729 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10735 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10789 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10788 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10852 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10853 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10816 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10047 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10048 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10481 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10482 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10484 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10051 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10483 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10555-10378 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10555-10378 Yes IE Cumulative 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10486-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10486-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10486-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10486-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10486-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10486-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10816 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10047 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10047 Yes IE Cumulative 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10048 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10048 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10481 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10481 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10482 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10482 Yes IE Cumulative 4038792 4034681 10486-10484 Yes Monthly Rollup 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10051 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10051 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10483 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10483 Yes IE Cumulative 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Internet Explorer Memory Corruption Vulnerability <p>A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website designed to exploit the vulnerability through Internet Explorer and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action, typically by an enticement in an email or instant message, or by getting the user to open an attachment sent through email.</p> <p>The security update addresses the vulnerability by modifying how Internet Explorer handles objects in memory.</p> Internet Explorer CVE-2017-8749 10555-10378 10486-10951 10486-10952 10486-10729 10486-10735 10486-10789 10486-10788 10486-10852 10486-10853 10486-10816 10486-10047 10486-10048 10486-10481 10486-10482 10486-10484 10486-10051 10486-10483 Remote Code Execution 10555-10378 Remote Code Execution 10486-10951 Remote Code Execution 10486-10952 Remote Code Execution 10486-10729 Remote Code Execution 10486-10735 Remote Code Execution 10486-10789 Remote Code Execution 10486-10788 Remote Code Execution 10486-10852 Remote Code Execution 10486-10853 Remote Code Execution 10486-10816 Remote Code Execution 10486-10047 Remote Code Execution 10486-10048 Remote Code Execution 10486-10481 Remote Code Execution 10486-10482 Remote Code Execution 10486-10484 Remote Code Execution 10486-10051 Remote Code Execution 10486-10483 Moderate 10555-10378 Critical 10486-10951 Critical 10486-10952 Critical 10486-10729 Critical 10486-10735 Critical 10486-10789 Critical 10486-10788 Critical 10486-10852 Critical 10486-10853 Moderate 10486-10816 Critical 10486-10047 Critical 10486-10048 Critical 10486-10481 Critical 10486-10482 Critical 10486-10484 Moderate 10486-10051 Moderate 10486-10483 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10555-10378 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10951 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10952 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10729 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10735 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10789 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10788 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10852 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10853 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10816 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10047 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10048 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10481 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10482 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10484 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10051 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10483 4038799 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038799 4034665 10555-10378 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10555-10378 Yes IE Cumulative 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10486-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10486-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10486-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10486-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10486-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10486-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10816 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10047 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10047 Yes IE Cumulative 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10048 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10048 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10481 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10481 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10482 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10482 Yes IE Cumulative 4038792 4034681 10486-10484 Yes Monthly Rollup 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10051 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10051 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10483 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10483 Yes IE Cumulative Hui Gao of <a href="https://www.paloaltonetworks.com/">Palo Alto Networks</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Browser Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft browsers, and then convince a user to view the website. The attacker could also take advantage of compromised websites, or websites that accept or host user-provided content or advertisements, by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically via an enticement in email or instant message, or by getting them to open an email attachment.</p> <p>The security update addresses the vulnerability by modifying how Microsoft browsers handle objects in memory.</p> Microsoft Browsers CVE-2017-8750 10486-10951 10486-10952 10486-10729 10486-10735 10486-10789 10486-10788 10486-10852 10486-10853 10486-10816 10486-10047 10486-10048 10486-10481 10486-10482 10486-10484 10486-10051 10486-10483 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 Remote Code Execution 10486-10951 Remote Code Execution 10486-10952 Remote Code Execution 10486-10729 Remote Code Execution 10486-10735 Remote Code Execution 10486-10789 Remote Code Execution 10486-10788 Remote Code Execution 10486-10852 Remote Code Execution 10486-10853 Remote Code Execution 10486-10816 Remote Code Execution 10486-10047 Remote Code Execution 10486-10048 Remote Code Execution 10486-10481 Remote Code Execution 10486-10482 Remote Code Execution 10486-10484 Remote Code Execution 10486-10051 Remote Code Execution 10486-10483 Remote Code Execution 10724-10729 Remote Code Execution 10724-10735 Remote Code Execution 10724-10789 Remote Code Execution 10724-10788 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Critical 10486-10951 Critical 10486-10952 Critical 10486-10729 Critical 10486-10735 Critical 10486-10789 Critical 10486-10788 Critical 10486-10852 Critical 10486-10853 Moderate 10486-10816 Critical 10486-10047 Critical 10486-10048 Critical 10486-10481 Critical 10486-10482 Critical 10486-10484 Moderate 10486-10051 Moderate 10486-10483 Critical 10724-10729 Critical 10724-10735 Critical 10724-10789 Critical 10724-10788 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:Exploitation More Likely 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10951 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10952 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10729 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10735 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10789 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10788 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10852 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10853 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10816 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10047 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10048 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10481 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10482 7.5 6.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10484 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10051 6.4 5.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C 10486-10483 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10729 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10735 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10486-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10486-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10486-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10486-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10486-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10486-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10486-10816 Yes Security Update 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10047 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10047 Yes IE Cumulative 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10048 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10048 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10481 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10481 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10482 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10482 Yes IE Cumulative 4038792 4034681 10486-10484 Yes Monthly Rollup 4038777 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038777 4034664 10486-10051 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10051 Yes IE Cumulative 4038792 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038792 4034681 10486-10483 Yes Monthly Rollup 4036586 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4036586 4034733 10486-10483 Yes IE Cumulative 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update likemeng of <a href="http://xlab.baidu.com">Baidu Security Lab</a> working with <a href="http://www.zerodayinitiative.com/">Trend Micro's Zero Day Initiative</a> 1.1 2017-09-12T07:00:00Z <p>Updated acknowledgment. This is an informational change only.</p> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Edge Memory Corruption Vulnerability <p>A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by way of enticement in an email or Instant Messenger message, or by getting them to open an attachment sent through email.</p> <p>The security update addresses the vulnerability by modifying how Microsoft Edge handles objects in memory.</p> Microsoft Edge CVE-2017-8751 10724-10951 10724-10952 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Critical 10724-10951 Critical 10724-10952 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update Lokihardt of <a href="https://www.google.com/">Google Project Zero</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Scripting Engine Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p> <p>The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.</p> Microsoft Scripting Engine CVE-2017-8752 10724-10951 10724-10952 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Remote Code Execution 10724-10789 Remote Code Execution 10724-10788 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Critical 10724-10951 Critical 10724-10952 Critical 10724-10789 Critical 10724-10788 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Scripting Engine Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p> <p>The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.</p> Microsoft Scripting Engine CVE-2017-8753 10724-10951 10724-10952 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Remote Code Execution 10724-10729 Remote Code Execution 10724-10735 Remote Code Execution 10724-10789 Remote Code Execution 10724-10788 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Critical 10724-10951 Critical 10724-10952 Critical 10724-10729 Critical 10724-10735 Critical 10724-10789 Critical 10724-10788 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10729 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10735 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update Yuki Chen of <a href="http://www.360.com/">Qihoo 360 Vulcan Team</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Edge Security Feature Bypass Vulnerability <p>A security feature bypass vulnerability exists in Microsoft Edge when the Edge <a href="https://technet.microsoft.com/en-us/library/security/dn848375.aspx#CSP">Content Security Policy (CSP)</a> fails to properly validate certain specially crafted documents. An attacker who exploited the bypass could trick a user into loading a page containing malicious content.</p> <p>To exploit the bypass, an attacker must trick a user into either loading a page containing malicious content or visiting a malicious website. The attacker could also inject the malicious page into either a compromised website or an advertisement network.</p> <p>The security update addresses the bypass by correcting how the Edge CSP validates documents.</p> Microsoft Edge CVE-2017-8754 10724-10951 10724-10952 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 Security Feature Bypass 10724-10951 Security Feature Bypass 10724-10952 Security Feature Bypass 10724-10729 Security Feature Bypass 10724-10735 Security Feature Bypass 10724-10789 Security Feature Bypass 10724-10788 Security Feature Bypass 10724-10852 Security Feature Bypass 10724-10853 Security Feature Bypass 10724-10816 Important 10724-10951 Important 10724-10952 Important 10724-10729 Important 10724-10735 Important 10724-10789 Important 10724-10788 Important 10724-10852 Important 10724-10853 Low 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10729 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10735 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update Jun Kokatsu (<a href="https://twitter.com/shhnjk/">@shhnjk</a>) 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Scripting Engine Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p> <p>The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.</p> Microsoft Edge CVE-2017-8755 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 10724-10951 10724-10952 Remote Code Execution 10724-10789 Remote Code Execution 10724-10788 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Critical 10724-10789 Critical 10724-10788 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Critical 10724-10951 Critical 10724-10952 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update Lokihardt of <a href="https://www.google.com/">Google Project Zero</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Scripting Engine Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p> <p>The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.</p> Microsoft Edge CVE-2017-8756 10724-10951 10724-10952 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Remote Code Execution 10724-10729 Remote Code Execution 10724-10735 Remote Code Execution 10724-10789 Remote Code Execution 10724-10788 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Critical 10724-10951 Critical 10724-10952 Critical 10724-10729 Critical 10724-10735 Critical 10724-10789 Critical 10724-10788 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10729 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10735 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Edge Memory Corruption Vulnerability <p>A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by way of enticement in an email or Instant Messenger message, or by getting them to open an attachment sent through email.</p> <p>The security update addresses the vulnerability by modifying how Microsoft Edge handles objects in memory.</p> Microsoft Edge CVE-2017-8757 10724-10951 10724-10952 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Remote Code Execution 10724-10729 Remote Code Execution 10724-10735 Remote Code Execution 10724-10789 Remote Code Execution 10724-10788 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Critical 10724-10951 Critical 10724-10952 Critical 10724-10729 Critical 10724-10735 Critical 10724-10789 Critical 10724-10788 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10729 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10735 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update Liu Long of <a href="http://www.360.com/">Qihoo 360Vulcan Team</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Exchange Information Disclosure Vulnerability <p>An input sanitization issue exists with Microsoft Exchange that could potentially result in unintended Information Disclosure. An attacker who successfully exploited the vulnerability could identify the existence of RFC1918 addresses on the local network from a client on the Internet. An attacker could use this internal host information as part of a larger attack.</p> <p>To exploit the vulnerability, an attacker could include specially crafted tags in Calendar-related messages sent to an Exchange server. These specially-tagged messages could prompt the Exchange server to fetch information from internal servers. By observing telemetry from these requests, a client could discern properties of internal hosts intended to be hidden from the Internet.</p> <p>The update corrects the way that Exchange parses Calendar-related messages.</p> Microsoft Exchange Server CVE-2017-11761 11449 11450 11470 11469 Information Disclosure 11449 Information Disclosure 11450 Information Disclosure 11470 Information Disclosure 11469 Important 11449 Important 11450 Important 11470 Important 11469 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation Unlikely 4045655 https://www.microsoft.com/downloads/details.aspx?familyid=0fc11c77-5442-4a64-92c4-bce25675ad32 4036108 11449 Yes Security Update 4045655 https://www.microsoft.com/downloads/details.aspx?familyid=572eec81-2998-48a3-be54-f4a2d067f268 4036108 11450 Yes Security Update 4045655 https://www.microsoft.com/downloads/details.aspx?familyid=9387fe84-723c-499b-b8b9-22e99aa910c0 11470 Yes Security Update 4045655 https://www.microsoft.com/downloads/details.aspx?familyid=c7db6072-e1be-4439-bbb3-b0cc13072fb7 11469 Yes Security Update Zhongcheng Li (CK01) 1.0 2017-09-12T07:00:00Z <p>Information published.</p> 2.0 2017-12-12T08:00:00Z <p>Security update package 4045655 released to address a known issue with the original security update. The 4045655 update removes the fix for this vulnerability. For more information regarding the known issue please see https://support.microsoft.com/en-us/help/4036108.</p> Scripting Engine Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based). The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (HTML-based) and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements. These websites could contain specially crafted content that could exploit the vulnerability.</p> <p>The security update addresses the vulnerability by modifying how the scripting engine handles objects in memory.</p> Microsoft Scripting Engine CVE-2017-11764 10724-10951 10724-10952 10724-10852 10724-10853 10724-10816 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Critical 10724-10951 Critical 10724-10952 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update Lokihardt of <a href="https://www.google.com/">Google Project Zero</a> 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Microsoft Edge Memory Corruption Vulnerability <p>A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge, and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by way of enticement in an email or Instant Messenger message, or by getting them to open an attachment sent through email.</p> <p>The security update addresses the vulnerability by modifying how Microsoft Edge handles objects in memory.</p> Microsoft Edge CVE-2017-11766 10724-10951 10724-10952 10724-10729 10724-10735 10724-10789 10724-10788 10724-10852 10724-10853 10724-10816 Remote Code Execution 10724-10951 Remote Code Execution 10724-10952 Remote Code Execution 10724-10729 Remote Code Execution 10724-10735 Remote Code Execution 10724-10789 Remote Code Execution 10724-10788 Remote Code Execution 10724-10852 Remote Code Execution 10724-10853 Remote Code Execution 10724-10816 Critical 10724-10951 Critical 10724-10952 Critical 10724-10729 Critical 10724-10735 Critical 10724-10789 Critical 10724-10788 Critical 10724-10852 Critical 10724-10853 Moderate 10724-10816 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10951 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10952 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10729 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10735 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10789 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10788 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10852 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10853 4.2 3.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C 10724-10816 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10724-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10724-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10724-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 10724-10816 Yes Security Update 1.0 2017-09-12T07:00:00Z <p>Information published.</p> Scripting Engine Memory Corruption Vulnerability <p>A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user.</p> <p>If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>The security update addresses the vulnerability by modifying how the ChakraCore scripting engine handles objects in memory.</p> Microsoft Scripting Engine CVE-2017-11767 11447 Remote Code Execution 11447 Critical 11447 Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely;Older Software Release:N/A Commit https://github.com/Microsoft/ChakraCore/releases/tag/v1.7.2 11447 Yes Security Update 1.0 2017-09-14T07:00:00Z <p>CVE-2017-11767 has been added to the September 2017 Security Release in conjunction with the publication of the 17-09 ChakraCore servicing release. See https://github.com/Microsoft/ChakraCore/commit/ee46fc449c5e7aa6753622720177b56dc4cc3abd for more information.</p> 1.1 2017-09-18T07:00:00Z <p>Corrected link to the Security Update on GitHub. This is an informational change only.</p> 1.2 2017-09-19T07:00:00Z <p>Revised description for CVE-2017-11767 to specify that the ChakraCore scripting engine is affected by this vulnerability. This is an informational change only.</p> .NET Framework Remote Code Execution Vulnerability <p>A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input. An attacker who successfully exploited this vulnerability in software using the .NET framework could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.</p> <p>To exploit the vulnerability, an attacker would first need to convince the user to open a malicious document or application.</p> <p>The security update addresses the vulnerability by correcting how .NET validates untrusted input.</p> <p><strong>How do I determine which version of Microsoft .NET Framework is installed on my system?</strong> You can install and run multiple versions of .NET Framework on a system, and you can install the versions in any order. For more information, see <a href="https://support.microsoft.com/kb/318785">Microsoft Knowledge Base Article 318785</a>.</p> <p><strong>How do I locate the updates for the versions of .NET Framework installed on my system?</strong> The download links in the Affected Products table are to the Parent KB number in the Microsoft Update Catalog. To locate the packages you need to download, in the Microsoft Update Catalog, click <strong>Download</strong> for the platform you have installed on your system. In the <strong>Download</strong> window, click to download each update that is applicable to your system.</p> <p>Customers who have updates automatically installed will be offered the Parent KB; however, the package KB numbers listed for each platform will be displayed in Add Remove Programs.</p> <p>The following table lists the Parent KB numbers for the Monthly Rollup Releases and the Security Only Releases, and the package KB numbers they contain. For more information about Microsoft's update servicing model for Microsoft .NET Framework, see this <a href="https://go.microsoft.com/fwlink/?linkid=829975">Microsoft .NET Blog Post</a>.</p> <table> <thead> <tr> <th></th> <th></th> <th>Monthly Rollup Release</th> <th></th> <th>Security Only Release</th> </tr> </thead> <tbody> <tr> <td>Platform</td> <td>Parent KB</td> <td>Child KBs</td> <td>Parent KB</td> <td>Child KBs</td> </tr> <tr> <td>Windows Server 2008</td> <td>4041086</td> <td>4040978 - .NET Framework 2.0</td> <td>4041093</td> <td>4040964 - .NET Framework 2.0</td> </tr> <tr> <td></td> <td></td> <td>4040977 - .NET Framework 4.5.2</td> <td></td> <td>4040960- .NET Framework 4.5.2</td> </tr> <tr> <td></td> <td></td> <td>4040973 - .NET Framework 4.6</td> <td></td> <td>4040957 - .NET Framework 4.6</td> </tr> <tr> <td>Windows 7</td> <td>4041083</td> <td>4040980 - .NET Framework 3.5.1</td> <td>4041090</td> <td>4040966 - .NET Framework 3.5.1</td> </tr> <tr> <td>Windows Server 2008 R2</td> <td></td> <td>4040977 - .NET Framework 4.5.2</td> <td></td> <td>4040960- .NET Framework 4.5.2</td> </tr> <tr> <td></td> <td></td> <td>4040973 - .NET Framework 4.6/4.6.1/4.6.2/4.7</td> <td></td> <td>4040957 - .NET Framework 4.6/4.6.1/4.6.2/4.7</td> </tr> <tr> <td>Windows Server 2012</td> <td>4041084</td> <td>4040979 - .NET Framework 3.5</td> <td>4041091</td> <td>4040965 - .NET Framework 3.5</td> </tr> <tr> <td></td> <td></td> <td>4040975 - .NET Framework 4.5.2</td> <td></td> <td>4040959 - .NET Framework 4.5.2</td> </tr> <tr> <td></td> <td></td> <td>4040971 - .NET Framework 4.6/4.6.1/4.6.2/4.7</td> <td></td> <td>4040955 - .NET Framework 4.6/4.6.1/4.6.2/4.7</td> </tr> <tr> <td>Windows 8.1</td> <td>4041085</td> <td>4040981 - .NET Framework 3.5</td> <td>4041092</td> <td>4040967 - .NET Framework 3.5</td> </tr> <tr> <td>Windows Server 2012 R2</td> <td></td> <td>4040974 - .NET Framework 4.5.2</td> <td></td> <td>4040958 - .NET Framework 4.5.2</td> </tr> <tr> <td></td> <td></td> <td>4040972 - .NET Framework 4.6/4.6.1/4.6.2/4.72</td> <td></td> <td>4040956 - .NET Framework 4.6/4.6.1/4.6.2/4.7</td> </tr> <tr> <td>Windows 10 Platforms</td> <td>Parent KB</td> <td>.NET Framework Product</td> <td></td> <td></td> </tr> <tr> <td>Windows 10</td> <td>4038781</td> <td>.NET Framework 3.5</td> <td></td> <td>None</td> </tr> <tr> <td></td> <td></td> <td>.NET Framework 4.6</td> <td></td> <td></td> </tr> <tr> <td>Windows 10 Version 1511</td> <td>4038783</td> <td>.NET Framework 3.5</td> <td></td> <td>None</td> </tr> <tr> <td></td> <td></td> <td>.NET Framework 4.6.1</td> <td></td> <td></td> </tr> <tr> <td>Windows 10 Version 1607</td> <td>4038782</td> <td>.NET Framework 3.5</td> <td></td> <td>None</td> </tr> <tr> <td></td> <td></td> <td>.NET Framework 4.6.2/4.7</td> <td></td> <td></td> </tr> <tr> <td>Windows Server 2016</td> <td>4038782</td> <td>.NET Framework 3.5</td> <td></td> <td>None</td> </tr> <tr> <td></td> <td></td> <td>.NET Framework 4.6.2/4.7</td> <td></td> <td></td> </tr> <tr> <td>Windows 10 Version 1703</td> <td>4038788</td> <td>.NET Framework 3.5</td> <td></td> <td>None</td> </tr> <tr> <td></td> <td></td> <td>.NET Framework 4.7</td> <td></td> <td></td> </tr> </tbody> </table> .NET Framework CVE-2017-8759 11437-10852 11437-10853 11437-10816 11437-10855 11451-10047 11451-10048 11451-10481 11451-10482 11451-10484 11451-10051 11451-10049 11451-10378 11451-10379 11451-10483 11451-10543 10957-10951 10957-10952 10728-10729 10728-10735 10728-9312 10728-9318 10808-10789 10808-10788 9292-9312 9292-9311 9292-9318 2472-10951 2472-10952 2472-10729 2472-10735 2472-10789 2472-10788 2472-10852 2472-10853 2472-10816 2472-10855 2472-10481 2472-10482 2472-10378 2472-10379 2472-10483 9495-10047 9495-10048 9495-10050 9495-10051 9495-10049 10636-10047 10636-10048 10636-10481 10636-10482 10636-10484 10636-9312 10636-9318 10636-10051 10636-10049 10636-10378 10636-10379 10636-10483 10636-10543 Remote Code Execution 11437-10852 Remote Code Execution 11437-10853 Remote Code Execution 11437-10816 Remote Code Execution 11437-10855 Remote Code Execution 11451-10047 Remote Code Execution 11451-10048 Remote Code Execution 11451-10481 Remote Code Execution 11451-10482 Remote Code Execution 11451-10484 Remote Code Execution 11451-10051 Remote Code Execution 11451-10049 Remote Code Execution 11451-10378 Remote Code Execution 11451-10379 Remote Code Execution 11451-10483 Remote Code Execution 11451-10543 Remote Code Execution 10957-10951 Remote Code Execution 10957-10952 Remote Code Execution 10728-10729 Remote Code Execution 10728-10735 Remote Code Execution 10728-9312 Remote Code Execution 10728-9318 Remote Code Execution 10808-10789 Remote Code Execution 10808-10788 Remote Code Execution 9292-9312 Remote Code Execution 9292-9311 Remote Code Execution 9292-9318 Remote Code Execution 2472-10951 Remote Code Execution 2472-10952 Remote Code Execution 2472-10729 Remote Code Execution 2472-10735 Remote Code Execution 2472-10789 Remote Code Execution 2472-10788 Remote Code Execution 2472-10852 Remote Code Execution 2472-10853 Remote Code Execution 2472-10816 Remote Code Execution 2472-10855 Remote Code Execution 2472-10481 Remote Code Execution 2472-10482 Remote Code Execution 2472-10378 Remote Code Execution 2472-10379 Remote Code Execution 2472-10483 Remote Code Execution 9495-10047 Remote Code Execution 9495-10048 Remote Code Execution 9495-10050 Remote Code Execution 9495-10051 Remote Code Execution 9495-10049 Remote Code Execution 10636-10047 Remote Code Execution 10636-10048 Remote Code Execution 10636-10481 Remote Code Execution 10636-10482 Remote Code Execution 10636-10484 Remote Code Execution 10636-9312 Remote Code Execution 10636-9318 Remote Code Execution 10636-10051 Remote Code Execution 10636-10049 Remote Code Execution 10636-10378 Remote Code Execution 10636-10379 Remote Code Execution 10636-10483 Remote Code Execution 10636-10543 Important 11437-10852 Important 11437-10853 Important 11437-10816 Important 11437-10855 Important 11451-10047 Important 11451-10048 Important 11451-10481 Important 11451-10482 Important 11451-10484 Important 11451-10051 Important 11451-10049 Important 11451-10378 Important 11451-10379 Important 11451-10483 Important 11451-10543 Important 10957-10951 Important 10957-10952 Important 10728-10729 Important 10728-10735 Important 10728-9312 Important 10728-9318 Important 10808-10789 Important 10808-10788 Important 9292-9312 Important 9292-9311 Important 9292-9318 Important 2472-10951 Important 2472-10952 Important 2472-10729 Important 2472-10735 Important 2472-10789 Important 2472-10788 Important 2472-10852 Important 2472-10853 Important 2472-10816 Important 2472-10855 Important 2472-10481 Important 2472-10482 Important 2472-10378 Important 2472-10379 Important 2472-10483 Important 9495-10047 Important 9495-10048 Important 9495-10050 Important 9495-10051 Important 9495-10049 Important 10636-10047 Important 10636-10048 Important 10636-10481 Important 10636-10482 Important 10636-10484 Important 10636-9312 Important 10636-9318 Important 10636-10051 Important 10636-10049 Important 10636-10378 Important 10636-10379 Important 10636-10483 Important 10636-10543 Publicly Disclosed:No;Exploited:Yes;Latest Software Release:Exploitation Detected;Older Software Release:Exploitation Detected 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 11437-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 11437-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 11437-10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 11437-10855 Yes Security Update 4040973 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041083 4019115, 4035039, 4014984, 4032116, 4019112, 4035036, 4014981, 4032113 11451-10047 Maybe Monthly Rollup 4040957 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041090 11451-10047 Maybe Security Only 4040973 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041083 4019115, 4035039, 4014984, 4032116, 4019112, 4035036, 4014981, 4032113 11451-10048 Maybe Monthly Rollup 4040957 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041090 11451-10048 Maybe Security Only 4040972 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041085 4019114, 4035038, 4014983, 4032115 11451-10481 Maybe Monthly Rollup 4040956 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041092 11451-10481 Maybe Security Only 4040972 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041085 4019114, 4035038, 4014983, 4032115 11451-10482 Maybe Monthly Rollup 4040956 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041092 11451-10482 Maybe Security Only 4040972 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041085 4019114, 4035038, 4014983, 4032115 11451-10484 Maybe Monthly Rollup 4040973 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041083 4019115, 4035039, 4014984, 4032116, 4019112, 4035036, 4014981, 4032113 11451-10051 Maybe Monthly Rollup 4040957 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041090 11451-10051 Maybe Security Only 4040973 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041083 4019115, 4035039, 4014984, 4032116, 4019112, 4035036, 4014981, 4032113 11451-10049 Maybe Monthly Rollup 4040957 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041090 11451-10049 Maybe Security Only 4040971 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041084 4019113, 4035037, 4014982, 4032114 11451-10378 Maybe Monthly Rollup 4040955 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041091 11451-10378 Maybe Security Only 4040971 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041084 4019113, 4035037, 4014982, 4032114 11451-10379 Maybe Monthly Rollup 4040955 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041091 11451-10379 Maybe Security Only 4040972 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041085 4019114, 4035038, 4014983, 4032115 11451-10483 Maybe Monthly Rollup 4040956 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041092 11451-10483 Maybe Security Only 4040972 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041085 4019114, 4035038, 4014983, 4032115 11451-10543 Maybe Monthly Rollup 4040956 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041092 11451-10543 Maybe Security Only 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10957-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 10957-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10728-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 10728-10735 Yes Security Update 4040973 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041086 4019115, 4035039, 4014984, 4032116, 4019112, 4035036, 4014981, 4032113 10728-9312 Maybe Monthly Rollup 4040957 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041093 10728-9312 Maybe Security Only 4040973 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041086 4019115, 4035039, 4014984, 4032116, 4019112, 4035036, 4014981, 4032113 10728-9318 Maybe Monthly Rollup 4040957 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041093 10728-9318 Maybe Security Only 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10808-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 10808-10788 Yes Security Update 4040978 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041086 4019115, 4035039, 4014984, 4032116 9292-9312 Maybe Monthly Rollup 4040964 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041093 2978116 9292-9312 Maybe Security Only 4040978 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041086 4019115, 4035039, 4014984, 4032116 9292-9311 Maybe Monthly Rollup 4040964 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041093 2978116 9292-9311 Maybe Security Only 4040978 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041086 4019115, 4035039, 4014984, 4032116 9292-9318 Maybe Monthly Rollup 4040964 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041093 2978116 9292-9318 Maybe Security Only 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 2472-10951 Yes Security Update 4038788 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038788 4034674 2472-10952 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 2472-10729 Yes Security Update 4038781 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038781 4034668 2472-10735 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 2472-10789 Yes Security Update 4038783 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038783 4034660 2472-10788 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 2472-10852 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 2472-10853 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 2472-10816 Yes Security Update 4038782 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4038782 4034658 2472-10855 Yes Security Update 4040981 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041085 4019114, 4035038, 4014983, 4032115 2472-10481 Maybe Monthly Rollup 4040967 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041092 2978122 2472-10481 Maybe Security Only 4040981 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041085 4019114, 4035038, 4014983, 4032115 2472-10482 Maybe Monthly Rollup 4040967 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041092 2978122 2472-10482 Maybe Security Only 4040979 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041084 4019113, 4035037, 4014982, 4032114 2472-10378 Maybe Monthly Rollup 4040965 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041091 2978121 2472-10378 Maybe Security Only 4040979 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041084 4019113, 4035037, 4014982, 4032114 2472-10379 Maybe Monthly Rollup 4040965 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041091 2978121 2472-10379 Maybe Security Only 4040981 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041085 4019114, 4035038, 4014983, 4032115 2472-10483 Maybe Monthly Rollup 4040967 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041092 2978122 2472-10483 Maybe Security Only 4040980 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041083 4019112, 4035036, 4014981, 4032113 9495-10047 Maybe Monthly Rollup 4040966 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041090 2978120 9495-10047 Maybe Security Only 4040980 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041083 4019112, 4035036, 4014981, 4032113 9495-10048 Maybe Monthly Rollup 4040966 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041090 2978120 9495-10048 Maybe Security Only 4040980 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041083 4019112, 4035036, 4014981, 4032113 9495-10050 Maybe Monthly Rollup 4040966 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041090 2978120 9495-10050 Maybe Security Only 4040980 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041083 4019112, 4035036, 4014981, 4032113 9495-10051 Maybe Monthly Rollup 4040966 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041090 2978120 9495-10051 Maybe Security Only 4040980 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041083 4019112, 4035036, 4014981, 4032113 9495-10049 Maybe Monthly Rollup 4040966 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041090 2978120 9495-10049 Maybe Security Only 4040977 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041083 4019115, 4035039, 4014984, 4032116, 4019112, 4035036, 4014981, 4032113 10636-10047 Maybe Monthly Rollup 4040960 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041090 2978128 10636-10047 Maybe Security Only 4040977 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041083 4019115, 4035039, 4014984, 4032116, 4019112, 4035036, 4014981, 4032113 10636-10048 Maybe Monthly Rollup 4040960 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041090 2978128 10636-10048 Maybe Security Only 4040974 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041085 4019114, 4035038, 4014983, 4032115 10636-10481 Maybe Monthly Rollup 4040958 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041092 2978126 10636-10481 Maybe Security Only 4040974 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041085 4019114, 4035038, 4014983, 4032115 10636-10482 Maybe Monthly Rollup 4040958 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041092 2978126 10636-10482 Maybe Security Only 4040974 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041085 4019114, 4035038, 4014983, 4032115 10636-10484 Maybe Monthly Rollup 4040977 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041086 4019115, 4035039, 4014984, 4032116, 4019112, 4035036, 4014981, 4032113 10636-9312 Maybe Monthly Rollup 4040960 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041093 2978128 10636-9312 Maybe Security Only 4040977 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041086 4019115, 4035039, 4014984, 4032116, 4019112, 4035036, 4014981, 4032113 10636-9318 Maybe Monthly Rollup 4040960 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041093 2978128 10636-9318 Maybe Security Only 4040977 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041083 4019115, 4035039, 4014984, 4032116, 4019112, 4035036, 4014981, 4032113 10636-10051 Maybe Monthly Rollup 4040960 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041090 2978128 10636-10051 Maybe Security Only 4040977 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041083 4019115, 4035039, 4014984, 4032116, 4019112, 4035036, 4014981, 4032113 10636-10049 Maybe Monthly Rollup 4040960 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041090 2978128 10636-10049 Maybe Security Only 4040975 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041084 4019113, 4035037, 4014982, 4032114 10636-10378 Maybe Monthly Rollup 4040959 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041091 2978127 10636-10378 Maybe Security Only 4040975 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041084 4019113, 4035037, 4014982, 4032114 10636-10379 Maybe Monthly Rollup 4040959 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041091 2978127 10636-10379 Maybe Security Only 4040974 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041085 4019114, 4035038, 4014983, 4032115 10636-10483 Maybe Monthly Rollup 4040958 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041092 2978126 10636-10483 Maybe Security Only 4040974 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041085 4019114, 4035038, 4014983, 4032115 10636-10543 Maybe Monthly Rollup 4040958 https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB4041092 2978126 10636-10543 Maybe Security Only Genwei Jiang and Dhanesh Kizhakkinan of <a href="https://www.fireeye.com/">FireEye, Inc.</a> 1.1 2017-09-12T07:00:00Z <p>Corrected Product versions and supersedence entries in the Affected Products table, corrected .NET versions in the table in the FAQ, and updated the acknowledgment. These are informational changes only. Customers who have already successfully installed the updates do not need to take any further action.</p> 1.2 2017-10-03T07:00:00Z <p>Corrected links to the Monthly Rollup KB articles for Microsoft .NET Framework 4.5.2 and Microsoft .NET Framework 4.6 installed on Windows Server 2008, and added a link to the 4041085 monthly rollup for Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7 installed on Windows RT 8.1. This is an informational change only. Customers who have successfully installed the updates do not need to take any further action.</p> 1.0 2017-09-12T07:00:00Z <p>Information published.</p>