October 2019 - Microsoft Releases Security Patches

Microsoft addresses several vulnerabilities in its October security bulletin. Trend Micro Deep Security covers the following:

• CVE-2019-1335 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in Microsoft Edge's Chakra scripting engine in respect to handling objects in memory. Attackers looking to exploit this vulnerability must find a way to convince a user to access a malicious website where the exploit is hosted.



• CVE-2019-1364 - Win32k Elevation of Privilege Vulnerability
  Risk Rating: Important
  
  This elevation of privilege vulnerability exists in the improper handling of objects in memory by the Windows kernel-mode driver. Attackers looking to exploit this vulnerability must find a way to be logged on to the vulnerable system.



• CVE-2019-1060 - MS XML Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper parsing of user input by the Microsoft XML Core Services MSXML. Attackers looking to exploit this vulnerability must find a way for a user to access a website using Internet Explorer.



• CVE-2019-1238 - VBScript Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by the VBScript engine. Attackers looking to exploit this vulnerability must find a way for a user to access a website where the exploit is hosted.



• CVE-2019-1239 - VBScript Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by the VBScript engine. Attackers looking to exploit this vulnerability must find a way for a user to access a website where the exploit is hosted.



• CVE-2019-1307 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability must find a way for a user to access a website where the exploit is hosted.



• CVE-2019-1308 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability must find a way for a user to access a website where the exploit is hosted.



• CVE-2019-1366 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability must find a way for a user to access a website where the exploit is hosted.



• CVE-2019-1361 - Microsoft Graphics Components Information Disclosure Vulnerability
  Risk Rating: Important
  
  This information disclosure vulnerability exists in the improper handling of objects in memory by the Microsoft Graphics Components. Attackers looking to exploit this vulnerability must find a way for a user to open a specially crafted file.