May 2019 - Microsoft Releases Security Patches

Microsoft addresses vulnerabilities in its May security bulletin. Trend Micro Deep Security covers the following:

• CVE-2019-0885 - Windows OLE Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in the validating of user input in Microsoft Windows OLE. Attackers looking to exploit this vulnerability must find a way to convince a user to execute a specially crafted file.



• CVE-2019-0938 - Microsoft Edge Elevation of Privilege Vulnerability
  Risk Rating: Important
  
  This elevation of privilege vulnerability exists in the handling of Microsoft Edge AppContainer sandbox that may allow an attacker to escape said sandbox.



• CVE-2019-0918 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in the handling of objects in memory in the scripting engine of Microsoft browsers. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.



• CVE-2019-0926 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of objects in memory by Microsoft Edge. This handling is corrected by this specific patch.



• CVE-2019-0940 - Microsoft Browser Memory Corruption Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in the handling of objects in memory by Microsoft browsers. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.



• CVE-2019-0882 - Windows GDI Information Disclosure Vulnerability
  Risk Rating: Important
  
  This information disclosure vulnerability exists in the improper disclosure of Windows GDI component of its objects in memory. Attackers looking to exploit this vulnerability may create a specially crafted document or webpage that contains an exploit to this vulnerability.



• CVE-2019-0863 - Windows Error Reporting Elevation of Privilege Vulnerability
  Risk Rating: Important
  
  This elevation of privilege vulnerability exists in the handling of files by the Windows Error Reporting. Attackers looking to exploit this vulnerability must gain certain privileges on the vulnerable machine.



• CVE-2019-0884 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft browsers. Attackers looking to exploit this vulnerability may gain the same user rights as the currently logged on user.



• CVE-2019-0930 - Internet Explorer Information Disclosure Vulnerability
  Risk Rating: Important
  
  This information disclosure vulnerability exists in the improper handling of objects in memory by Internet Explorer. Attackers looking to exploit this vulnerability may create a specially crafted website and convince the user to view said website.



• CVE-2019-0911 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of objects in memory by the scripting engine in Microsoft browsers. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.



• CVE-2019-0708 - Remote Desktop Services Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of specially crafted requests by the Remote Desktop Services (also known as Terminal Services in older Microsoft Windows operating systems). Attackers looking to exploit this vulnerability may send a specially crafted request to the vulnerable system.