Fecha recomendada: 12 de junio de 2019

  Descripción

Microsoft addresses vulnerabilities in its June security bulletin. Trend Micro Deep Security covers the following:

  • CVE-2019-0985 - Microsoft Speech API Remote Code Execution Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the improper handling of text-to-speech input in Microsoft Speech API. Attackers looking to exploit this vulnerability must find a way to convince a user to execute a specially crafted file.


  • CVE-2019-1003 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory by the Microsoft Edge Chakra scripting engine. Attackers looking to exploit this vulnerability must find a way to convince a user to visit a specially crafted webpage that contains an exploit to this vulnerability.


  • CVE-2019-0991 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory in the Chakra scripting engine of Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-0540 - Microsoft Office Security Feature Bypass Vulnerability
    Risk Rating: Important

    This security bypass vulnerability exists in the non-validation of URLs by Microsoft Office. This handling is corrected by this specific patch.


  • CVE-2019-1005 - Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Important

    This remote code execution vulnerability exists in the handling of objects in memory by Microsoft browsers. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-1051 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the improper handling of objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may create a specially crafted webpage that contains an exploit to this vulnerability.


  • CVE-2019-0993 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the improper handling of objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may create a specially crafted webpage that contains an exploit to this vulnerability.


  • CVE-2019-0920 - Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft browsers. Attackers looking to exploit this vulnerability may gain the same user rights as the currently logged on user.


  • CVE-2019-1052 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the improper handling of objects in memory by Microsoft Edge. Attackers looking to exploit this vulnerability may create a specially crafted website and convince the user to view said website.


  • CVE-2019-0989 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-1002 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-0992 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-0988 - Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Internet Explorer. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-1055 - Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft browsers. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-1023 - Scripting Engine Information Disclosure Vulnerability
    Risk Rating: Critical

    This information disclosure vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-0990 - Scripting Engine Information Disclosure Vulnerability
    Risk Rating: Critical

    This information disclosure vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-1024 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This information disclosure vulnerability exists in the handling of objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  Revelación de la información

Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using the Vulnerability Protection product or OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities.

Vulnerability ID DPI Rule Number DPI Rule Name Release Date Vulnerability Protection Compatibility
CVE-2019-0985 1009778 Microsoft Windows Speech API Remote Code Execution Vulnerability (CVE-2019-0985) 11-Jun-19 YES
CVE-2019-1003 1009790 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1003) 11-Jun-19 YES
CVE-2019-0943, CVE-2019-0984, CVE-2019-0986, CVE-2019-1017, CVE-2019-1041, CVE-2019-1053, CVE-2019-1064, CVE-2019-1069 100779 Microsoft Windows Multiple Security Vulnerabilities (June-2019) 11-Jun-19 YES
CVE-2019-0991 1009786 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0991) 11-Jun-19 YES
CVE-2019-0540 1009764 Microsoft Office Security Feature Bypass Vulnerability (CVE-2019-0540) 11-Jun-19 YES
CVE-2019-1005 1009791 Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-1005) 11-Jun-19 YES
CVE-2019-1051 1009788 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1051) 11-Jun-19 YES
CVE-2019-0993 1009784 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0993) 11-Jun-19 YES
CVE-2019-0920 1009781 Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-0920) 11-Jun-19 YES
CVE-2019-1052 1009792 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1052) 11-Jun-19 YES
CVE-2019-0989 1009785 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0989) 11-Jun-19 YES
CVE-2019-1002 1009789 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1002) 11-Jun-19 YES
CVE-2019-0992 1009783 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0992) 11-Jun-19 YES
CVE-2019-0988 1009780 Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-0988) 11-Jun-19 YES
CVE-2019-1055 1009793 Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-1055) 11-Jun-19 YES
CVE-2019-1023 1009794 Microsoft Edge Scripting Engine Information Disclosure Vulnerability (CVE-2019-1023) 11-Jun-19 YES
CVE-2019-0990 1009782 Microsoft Edge Scripting Engine Information Disclosure Vulnerability (CVE-2019-0990) 11-Jun-19 YES
CVE-2019-1024 1009787 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-1024) 11-Jun-19 YES