October 2018 - Microsoft Releases Security Patches

Microsoft addresses vulnerabilities in its October security bulletin. Trend Micro Deep Security covers the following:

• CVE-2018-8411 - NTFS Elevation of Privilege Vulnerability
  Risk Rating: Important
  
  This elevation of privilege vulnerability exists in the checking of access by NTFS. Attackers looking to exploit this vulnerability must be able to log on to the system.



• CVE-2018-8453 - Win32k Elevation of Privilege Vulnerability
  Risk Rating: Important
  
  This elevation of privilege vulnerability exists in the failure to properly handle objects in memory by the Win32k component. Attackers looking to exploit this vulnerability must be able to log on to the system.



• CVE-2018-8486 - DirectX Information Disclosure Vulnerability
  Risk Rating: Critical
  
  This information disclosure vulnerability exists the DirectX component. The vulnerability exists in the way it handles objects in memory.



• CVE-2018-8492 - Device Guard Code Integrity Policy Security Feature Bypass Vulnerability
  Risk Rating: Important
  
  This security feature bypass vulnerability in Device Guard isresolved by the Microsoft patch. Attackers who successfully exploit this vulnerability must have access to the local machine.



• CVE-2018-8413 - Windows Theme API Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in the decompressing of files by the Windows Theme API. This handling is corrected by this specific patch.



• CVE-2018-8333 - Microsoft Filter Manager Elevation Of Privilege Vulnerability
  Risk Rating: Important
  
  The elevation of privilege vulnerability exists in the improper handling of objects in memory by the Filter Manager. This handling is corrected by this specific patch.



• CVE-2018-8505 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by the Chakra scripting engine. This handling is corrected by this specific patch.



• CVE-2018-8495 - Windows Shell Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in the improper handling of URIs by the Windows Shell. This handling is corrected by this specific patch.



• CVE-2018-8491 - Internet Explorer Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper access of objects in memory by Internet Explorer. This handling is corrected by this specific patch.



• CVE-2018-8460 - Internet Explorer Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by Microsoft Edge PDF Reader. This handling is corrected by this specific patch.