September 2018 - Microsoft Releases Security Patches

Microsoft addresses vulnerabilities in its September security bulletin. Trend Micro Deep Security covers the following:

• CVE-2018-8440 - Windows ALPC Elevation of Privilege Vulnerability
  Risk Rating: Important
  
  This elevation of privilege vulnerability exists in the Advanced Local Procedure Call (ALPC) of Windows. Calls to ALPC may be exploited by an attacker to successfully exploit this vulnerability.



• CVE-2018-8367 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the way the Chakra scripting engine of Microsoft Edge handles objects in memory. An attacker must convince a user to open a specially-crafted webpage to exploit this vulnerability.



• CVE-2018-8391 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the ChakraCore scripting engine. The vulnerability exists in the way it handles objects in memory.



• CVE-2018-8420 - MS XML Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the way the MSXML input parser of Microsoft XML Core Services. An attacker must convince a user to access a specially-crafted webpage to exploit this vulnerability.



• CVE-2018-8442 - Windows Kernel Information Disclosure Vulnerability
  Risk Rating: Important
  
  This information disclosure vulnerability exists in the handling of objects in memory by the Windows kernel. This handling is corrected by this specific patch.



• CVE-2018-8447 - Internet Explorer Memory Corruption Vulnerability
  Risk Rating: Critical
  
  The remote code execution vulnerability exists in the improper handling of objects in memory by Internet Explorer. This handling is corrected by this specific patch.



• CVE-2018-8456 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by the ChakraCore scripting engine. This handling is corrected by this specific patch.



• CVE-2018-8459 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by the ChakraCore scripting engine. This handling is corrected by this specific patch.



• CVE-2018-8461 - Internet Explorer Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by Internet Explorer. This handling is corrected by this specific patch.



• CVE-2018-8464 - Microsoft Edge PDF Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by Microsoft Edge PDF Reader. This handling is corrected by this specific patch.



• CVE-2018-8466 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by the Chakra scripting engine in Microsoft Edge. This handling is corrected by this specific patch.



• CVE-2018-8467 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by the Chakra scripting engine in Microsoft Edge. This handling is corrected by this specific patch.



• CVE-2018-8470 - Internet Explorer Security Feature Bypass Vulnerability
  Risk Rating: Important
  
  This security feature bypass vulnerability exists in Internet Explorer. This is due to its handling of scripts, which can allow universal cross-site scripting. This handling is corrected by this specific patch.



• CVE-2018-8475 - Windows Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the image handling of Windows. This handling is corrected by this specific patch.