March 2019 - Microsoft Releases Security Patches

Microsoft addresses vulnerabilities in its March security bulletin. Trend Micro Deep Security covers the following:

• CVE-2019-0763 - Internet Explorer Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of objects in memory in Internet Explorer. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.



• CVE-2019-0768 - Internet Explorer Security Feature Bypass Vulnerability
  Risk Rating: Important
  
  This security feature bypass vulnerability exists in the improper restricting of certain conditions in the Internet Explorer VBScript execution policy. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.



• CVE-2019-0609 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of objects in memory in the scripting engine of Microsoft browsers. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.



• CVE-2019-0667 - Windows VBScript Engine Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of objects in memory by the VBScript engine. This handling is corrected by this specific patch.



• CVE-2019-0592 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of objects in memory in the Chakra scripting engine of Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.



• CVE-2019-0771 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of objects in memory in the scripting engine of Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.



• CVE-2019-0590 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of objects in memory in the scripting engine of Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.



• CVE-2019-0639 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of objects in memory by the ChakraCore scripting engine. Attackers looking to exploit this vulnerability may gain the same user rights as the currently logged on user.



• CVE-2019-0773 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of of objects in memory . Attackers looking to exploit this vulnerability may create a specially crafted website and convince the user to view said website.



• CVE-2019-0666 - Windows VBScript Engine Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the handling of objects in memory by the VBScript engine. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.



• CVE-2019-0703 - Windows SMB Information Disclosure Vulnerability
  Risk Rating: Important
  
  This information disclosure vulnerability exists in certain handling of requests by the Windows SMB Server. Attackers looking to exploit this vulnerability will have to be able to authenticate SMB messages that they will send to the vulnerable SMB Server.



• CVE-2019-0797 - Win32k Elevation of Privilege Vulnerability
  Risk Rating: Important
  
  This elevation of privilege vulnerability exists in the improper handling of objects in memory by the Win32k component. Attackers looking to exploit this vulnerability may find a way to persuade users to open a specially crafted application.



• CVE-2019-0665 - Windows VBScript Engine Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by the Windows VBScript engine. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.



• CVE-2019-0770 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.



• CVE-2019-0808 - Win32k Elevation of Privilege Vulnerability
  Risk Rating: Important
  
  This elevation of privilege vulnerability exists in the improper handling of objects in memory by the Win32k component. Attackers looking to exploit this vulnerability may find a way to persuade users to open a specially crafted application.



• CVE-2019-0680 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by Microsoft Edge. Attackers looking to exploit this vulnerability may host a specially crafted website that contains an exploit to this vulnerability.



• CVE-2019-0769 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by Microsoft Edge. This update changes certain functions in the scripting engine when it handle objects in memory.



• CVE-2019-0612 - Microsoft Edge Security Feature Bypass Vulnerability
  Risk Rating: Important
  
  This security feature bypass vulnerability exists in the improper handling of flash objects by the Click2Play protection in Microsoft Edge. This update changes certain functions when it handle objects in memory.