December 2018 - Microsoft Releases Security Patches

Microsoft addresses vulnerabilities in its December security bulletin. Trend Micro Deep Security covers the following:

• CVE-2018-8631 - Internet Explorer Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This memory corruption vulnerability exists in the way Internet Explorer accesses objects in memory. Attackers looking to exploit this vulnerability must convince a user to visit a specially crafted website that hosts the exploit to this vulnerability.



• CVE-2018-8624 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the failure to handle objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability must convince a user to visit a specially crafted website that hosts the exploit to this vulnerability.



• CVE-2018-8629 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the failure to handle objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability must convince a user to visit a specially crafted website that hosts the exploit to this vulnerability.



• CVE-2018-8643 - Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability in the scripting engine in Internet Explorer is resolved by this patch. Attackers looking to exploit this vulnerability must convince a user to visit a specially crafted website that hosts the exploit to this vulnerability.



• CVE-2018-8625 - Windows VBScript Engine Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in the handling of objects in memory by the VBScript engine in Windows. This handling is corrected by this specific patch.



• CVE-2018-8634 - Microsoft Text-To-Speech Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  The remote code execution vulnerability exists in the improper handling of objects in memory by the Microsoft text-to-speech in Windows. This handling is corrected by this specific patch.



• CVE-2018-8628 - Microsoft PowerPoint Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by Microsoft PowerPoint. This handling is corrected by this specific patch.



• CVE-2018-8583 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper handling of objects in memory by the Chakra scripting engine in Microsoft Edge. This handling is corrected by this specific patch.



• CVE-2018-8618 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper access of objects in memory by the Chakra scripting engine in Microsoft Edge. This handling is corrected by this specific patch.



• CVE-2018-8587 - Microsoft Outlook Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in the improper access of objects in memory by Microsoft Outlook. This handling is corrected by this specific patch.



• CVE-2018-8617 - Chakra Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the improper access of objects in memory by the Chakra scripting engine in Microsoft Edge. This handling is corrected by this specific patch.



• CVE-2018-8619 - Internet Explorer Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This remote code execution vulnerability exists in the improper restricting of VBScript Internet Explorer VBScript execution policy under specific conditions. This handling is corrected by this specific patch.