April 2018 - Microsoft Releases Security Patches

Microsoft addresses vulnerabilities in its April security bulletin. Trend Micro Deep Security covers the following:

• CVE-2018-0994 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the Chakra scripting engine of Microsoft Edge. Objects in memory may be corrupted by an attacker, causing the vulnerability.



• CVE-2018-1028 - Microsoft Office Graphics Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in the handling of embedded fonts by Office graphics component. The Windows Font library is corrected by this specific patch.



• CVE-2018-1010 - Microsoft Office Graphics Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of embedded fonts by Windows font library. The Windows Font library is corrected by this specific patch.



• CVE-2018-1012 - Microsoft Graphics Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of embedded fonts by Windows font library. The Windows Font library is corrected by this specific patch.



• CVE-2018-1013 - Microsoft Graphics Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of embedded fonts by Windows font library. The Windows Font library is corrected by this specific patch.



• CVE-2018-1015 - Microsoft Graphics Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of embedded fonts by Windows font library. The Windows Font library is corrected by this specific patch.



• CVE-2018-1016 - Microsoft Graphics Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of embedded fonts by Windows font library. The Windows Font library is corrected by this specific patch.



• CVE-2018-1004 - Windows VBScript Engine Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability is addressed in the current security update from Microsoft. This vulnerability exists in the way the scripting engine handles objects in memory.



• CVE-2018-1003 - Microsoft JET Database Engine Remote Code Execution Vulnerability
  Risk Rating: Important
  
  The buffer overflow vulnerability exists in the way the Microsoft JET Database handles objects in memory. When exploited successfully, it gives attackers control of the vulnerable system.



• CVE-2017-11779 - Windows DNSAPI Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  The vulnerability exists in the way the DNSAPI.dll component handles DNS responses. This remote code execution vulnerability, when exploited successfully, allows attackers to execute code of their choice on the vulnerable system.



• CVE-2018-0993 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the Chakra scripting engine of Microsoft Edge. Objects in memory may be corrupted by an attacker, causing the vulnerability.



• CVE-2018-0986 - Microsoft Malware Protection Engine Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  The memory corruption vulnerability exists in the way Microsoft Malware Protection Engine scans a specially crafted file. This update corrects the vulnerability.



• CVE-2018-1018 - Internet Explorer Memory Corruption Vulnerability
  Risk Rating: Critical
  
  The vulnerability exists in the way Internet Explorer accesses objects in memory. Attackers looking to exploit this remote code execution vulnerability must convince the user to click on a malicious link or find a way to entice user that will exploit this vulnerability.



• CVE-2018-0998 - Microsoft Edge Information Disclosure Vulnerability
  Risk Rating: Important
  
  This information disclosure vulnerability exists in the Microsoft Edge PDF Reader. It is resolved by the update that modifies the way the said reader handles objects in memory.



• CVE-2018-0883 - Windows Shell Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in Windows Shell. It is resolved by ensuring that Windows Shell has a way to validate file copy destinations.



• CVE-2018-1026 - Microsoft Office Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in Microsoft Office. It is resolved by correcting the way Microsoft Office handles objects in memory.



• CVE-2018-1011 - Microsoft Excel Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in Microsoft Excel. It is resolved by correcting the way Microsoft Excel handles objects in memory.



• CVE-2018-0991 - Internet Explorer Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in Internet Explorer. It is resolved by correcting the way Internet Explorer handles objects in memory.



• CVE-2018-0995 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in Chakra scripting engine in Microsoft Edge. It is resolved by correcting the way Chakra scripting engine handles objects in memory.



• CVE-2018-1001 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in the scripting engine in Internet Explorer. It is resolved by correcting the way the scripting engine handles objects in memory.



• CVE-2018-0990 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in Chakra scripting engine in Microsoft Edge. It is resolved by correcting the way Chakra scripting engine handles objects in memory.



• CVE-2018-0996 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the scripting engine in Internet Explorer. It is resolved by correcting the way the scripting engine handles objects in memory.



• CVE-2018-0802 - Microsoft Office Memory Corruption Vulnerability (CVE-2018-0802) - 1
  Risk Rating: Important
  
  This remote code execution vulnerability exists in Microsoft Office. It is resolved by removing the Equation Editor function.



• CVE-2018-1029 - Microsoft Excel Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in Microsoft Excel. It is resolved by correcting the way Microsoft Excel handles objects in memory.



• CVE-2018-0878 - Windows Remote Assistance Information Disclosure Vulnerability
  Risk Rating: Important
  
  This information disclosure vulnerability exists in Windows Remote Assistance. It is resolved by correcting the way Windows Remote Assistance handles XML External Entities (XXE).



• CVE-2018-0920 - Microsoft Excel Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in Microsoft Excel. It is resolved by correcting the way Microsoft Excel handles objects in memory.



• CVE-2018-0997 - Internet Explorer Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in Internet Explorer. It is resolved by correcting the way Internet Explorer handles objects in memory.



• CVE-2018-0990 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in Chakra scripting engine in Microsoft Edge. It is resolved by correcting the way Chakra scripting engine handles objects in memory.



• CVE-2018-1030 - Microsoft Office Memory Corruption Vulnerability (CVE-2018-0802) - 1
  Risk Rating: Important
  
  This remote code execution vulnerability exists in Microsoft Office. It is resolved by correcting the way Microsoft Office handles objects in memory.



• CVE-2018-0988 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the scripting engine in Internet Explorer. It is resolved by correcting the way the scripting engine handles objects in memory.



• CVE-2018-0988 - Internet Explorer Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the Internet Explorer. It is resolved by correcting the way Internet Explorer handles objects in memory.



• CVE-2018-1027 - Microsoft Excel Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in Microsoft Excel. It is resolved by correcting the way Microsoft Excel handles objects in memory.