Date du conseil: 10 avril 2019

  Description

Microsoft addresses vulnerabilities in its April security bulletin. Trend Micro Deep Security covers the following:

  • CVE-2019-0861 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-0862 - Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Important

    This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Internet Explorer. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-0752 - Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Important

    This remote code execution vulnerability exists in the handling of objects in memory in the scripting engine of Internet Explorer. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-0829 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory by the Chakra scripting engine in Microsoft Edge. This handling is corrected by this specific patch.


  • CVE-2019-0794 - OLE Automation Remote Code Execution Vulnerability
    Risk Rating: Important

    This remote code execution vulnerability exists in the handling of objects in memory by the OLE automation. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-0803 - Win32k Elevation of Privilege Vulnerability
    Risk Rating: Important

    This elevation of privilege vulnerability exists in the handling of objects in memory by the Win32k component. Attackers looking to exploit this vulnerability may create a specially crafted application that contains an exploit to this vulnerability.


  • CVE-2019-0793 - MS XML Remote Code Execution Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the input parsing of the Microsoft XML Core Services MSXML parser. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-0806 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may gain the same user rights as the currently logged on user.


  • CVE-2019-0753 - Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine of Internet Explorer. Attackers looking to exploit this vulnerability may create a specially crafted website and convince the user to view said website.


  • CVE-2019-0812 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-0860 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the handling of objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.


  • CVE-2019-0810 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This elevation of privilege vulnerability exists in the improper handling of objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability may find a way to persuade users to open a specially crafted website.


  • CVE-2019-0801 - Office Remote Code Execution Vulnerability
    Risk Rating: Important

    This remote code execution vulnerability exists in the improper handling of files by the Microsoft Office. Attackers looking to exploit this vulnerability may host a specially crafted Excel or PowerPoint file that contains an exploit to this vulnerability.


  • CVE-2019-0822 - Microsoft Graphics Components Remote Code Execution Vulnerability
    Risk Rating: Important

    This remote code execution vulnerability exists in the improper handling of objects in memory by Microsoft Graphics Components. Attackers looking to exploit this vulnerability may host a specially crafted file that contains an exploit to this vulnerability.


  Information Exposure Rating:

Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using the Vulnerability Protection product or OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities.

Vulnerability ID DPI Rule Number DPI Rule Name Release Date Vulnerability Protection Compatibility
CVE-2019-0861 1009657 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0861) 10-Apr-19 YES
CVE-2019-0768 1009570 Microsoft Internet Explorer Security Feature Bypass Vulnerability (CVE-2019-0768) 10-Apr-19 YES
CVE-2019-0609 1009575 Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2019-0609) 10-Apr-19 YES
CVE-2019-0862 1009654 Microsoft Windows VBScript Engine Remote Code Execution Vulnerability (CVE-2019-0862) 10-Apr-19 YES
CVE-2019-0752 1009655 Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-0752) 10-Apr-19 YES
CVE-2019-0829 1009660 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0829) 10-Apr-19 YES
CVE-2019-0794 1009651 Microsoft XML Remote Code Execution Vulnerability (CVE-2019-0794) 10-Apr-19 YES
CVE-2019-0803 1009647 Microsoft Windows GDI Elevation Of Privilege Vulnerability (CVE-2019-0803) 10-Apr-19 YES
CVE-2019-0793 1009650 Microsoft XML Remote Code Execution Vulnerability (CVE-2019-0793) 10-Apr-19 YES
CVE-2019-0806 1009652 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0806) 10-Apr-19 YES
CVE-2019-0753 1009656 Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-0753) 10-Apr-19 YES
CVE-2019-0812 1009659 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0812) 10-Apr-19 YES
CVE-2019-0860 1009661 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0860) 10-Apr-19 YES
CVE-2019-0685, CVE-2019-0814, CVE-2019-0840, CVE-2019-0844, CVE-2019-0859 1009649 Microsoft Windows Multiple Security Vulnerabilities (Apr-2019) 10-Apr-19 YES
CVE-2019-0810 1009658 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2019-0810) 10-Apr-19 YES
CVE-2019-0801 1009646 Microsoft Office Remote Code Execution Vulnerability (CVE-2019-0801) 10-Apr-19 YES
CVE-2019-0822 1009653 Microsoft Graphics Components Remote Code Execution Vulnerability (CVE-2019-0822) 10-Apr-19 YES