July 2018 - Microsoft Releases Security Patches
Advisory Date: JUL 11, 2018
DESCRIPTION
Microsoft addresses vulnerabilities in its July security bulletin. Trend Micro Deep Security covers the following:
- CVE-2018-8298 - Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the ChakraCore scripting engine. Objects in memory may be corrupted by an attacker, causing the vulnerability. - CVE-2018-8274 - Microsoft Edge Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the handling of objects in memory in Microsoft Edge. This handling is corrected by this specific patch. - CVE-2018-8296 - Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the handling of objects in memory by Internet Explorer. This handling is corrected by this specific patch. - CVE-2018-8283 - Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the handling of objects in memory by the ChakraCore scripting engine. This handling is corrected by this specific patch. - CVE-2018-8278 - Microsoft Edge Spoofing Vulnerability
Risk Rating: Important
This spoofing vulnerability exists in the handling of specific HTML content by Microsoft Edge. This handling is corrected by this specific patch. - CVE-2018-8291 - Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the handling of objects in memory by Microsoft Edge and Internet Explorer. This handling is corrected by this specific patch. - CVE-2018-8125 - Microsoft Edge Memory Corruption Vulnerability
Risk Rating: Important
This remote code execution vulnerability exists in the handling of objects in memory by Microsoft Edge. This handling is corrected by this specific patch. - CVE-2018-8324 - Microsoft Edge Information Disclosure Vulnerability
Risk Rating: Critical
This information disclosure vulnerability exists in the handling of objects in memory by Microsoft Edge. This handling is corrected by this specific patch. - CVE-2018-8262 - Microsoft Edge Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the handling of objects in memory by Microsoft Edge. This handling is corrected by this specific patch. - CVE-2018-8289 - Microsoft Edge Information Disclosure Vulnerability
Risk Rating: Important
The information disclosure vulnerability exists in the improper handling of objects in memory by Microsoft Edge. This handling is corrected by this specific patch. - CVE-2018-8275 - Microsoft Edge Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in Microsoft Edge. Objects in memory may be corrupted by an attacker, causing the vulnerability. - CVE-2018-8279 - Microsoft Edge Memory Corruption Vulnerability
Risk Rating: Critical
This remote code execution vulnerability exists in the handling of objects in memory by Microsoft Edge. This handling is corrected by this specific patch. - CVE-2018-0949 - Internet Explorer Security Feature Bypass Vulnerability
Risk Rating: Important
This security feature bypass vulnerability exists in Microsoft Internet Explorer when handling UNC resources. This handling is corrected by this specific patch. - CVE-2018-8297 - Microsoft Edge Information Disclosure Vulnerability
Risk Rating: Important
This information disclosure vulnerability exists in the way Microsoft Edge handles objects in memory. This handling is corrected by this specific patch. - CVE-2018-8242 - Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This information disclosure vulnerability exists in the way Internet Explorer handles objects in memory. This handling is corrected by this specific patch. - CVE-2018-8288 - Scripting Engine Memory Corruption Vulnerability
Risk Rating: Critical
This information disclosure vulnerability exists in the way Internet Explorer and Microsoft Edge handles objects in memory. This handling is corrected by this specific patch.
TREND MICRO PROTECTION INFORMATION
Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using the Vulnerability Protection product or OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities.
| Vulnerability ID | DPI Rule Number | DPI Rule Name | Release Date | Vulnerability Protection Compatibility |
| CVE-2018-8298 | 1009187 | Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-8298) | 11-Jul-18 | YES |
| CVE-2018-8296 | 1009185 | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2018-8296) | 11-Jul-18 | YES |
| CVE-2018-8283 | 1009181 | Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-8283) | 11-Jul-18 | YES |
| CVE-2018-8278 | 1009194 | Microsoft Edge Spoofing Vulnerability (CVE-2018-8278) | 11-Jul-18 | YES |
| CVE-2018-8291 | 1009184 | Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-8291) | 11-Jul-18 | YES |
| CVE-2018-8125 | 1009189 | Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-8125) | 11-Jul-18 | YES |
| CVE-2018-8324 | 1009196 | Microsoft Edge Information Disclosure Vulnerability (CVE-2018-8324) | 11-Jul-18 | YES |
| CVE-2018-8262 | 1009191 | Microsoft Edge Memory Corruption Vulnerability (CVE-2018-8262) | 11-Jul-18 | YES |
| CVE-2018-8289 | 1009183 | Microsoft Edge Information Disclosure Vulnerability (CVE-2018-8289) | 11-Jul-18 | YES |
| CVE-2018-8275 | 1009193 | Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-8275) | 11-Jul-18 | YES |
| CVE-2018-8279 | 1009141 | Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-8279) | 11-Jul-18 | YES |
| CVE-2018-0949 | 1009188 | Microsoft Internet Explorer Security Feature Bypass Vulnerability (CVE-2018-0949) | 11-Jul-18 | YES |
| CVE-2018-8297 | 1009186 | Microsoft Edge Information Disclosure Vulnerability (CVE-2018-8297) | 11-Jul-18 | YES |
| CVE-2018-8242 | 1009190 | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2018-8242) | 11-Jul-18 | YES |
| CVE-2018-8288 | 1009182 | Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2018-8288) | 11-Jul-18 | YES |
Featured Stories
The Mirage of AI Programming: Hallucinations and Code IntegrityThe adoption of large language models (LLMs) and Generative Pre-trained Transformers (GPTs), such as ChatGPT, by leading firms like Microsoft, Nuance, Mix and Google CCAI Insights, drives the industry towards a series of transformative changes. As the use of these new technologies becomes prevalent, it is important to understand their key behavior, advantages, and the risks they present.Read more
Open RAN: Attack of the xAppsThis article discusses two O-RAN vulnerabilities that attackers can exploit. One vulnerability stems from insufficient access control, and the other arises from faulty message handlingRead more
A Closer Exploration of Residential Proxies and CAPTCHA-Breaking ServicesThis article, the final part of a two-part series, focuses on the details of our technical findings and analyses of select residential proxies and CAPTCHA-solving services.Read more
How Residential Proxies and CAPTCHA-Solving Services Become Agents of AbuseThis article, the first of a two-part series, provides insights on how abusers and cybercriminals use residential proxies and CAPTCHA-solving services to enable bots, scrapers, and stuffers, and proposes security countermeasures for organizations.Read more