December 2018 - Microsoft Releases Security Patches

Publish date: May 28, 2020
  Advisory Date: DEC 12, 2018

  DESCRIPTION

Microsoft addresses vulnerabilities in its December security bulletin. Trend Micro Deep Security covers the following:

  • CVE-2018-8631 - Internet Explorer Memory Corruption Vulnerability
    Risk Rating: Critical

    This memory corruption vulnerability exists in the way Internet Explorer accesses objects in memory. Attackers looking to exploit this vulnerability must convince a user to visit a specially crafted website that hosts the exploit to this vulnerability.


  • CVE-2018-8624 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the failure to handle objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability must convince a user to visit a specially crafted website that hosts the exploit to this vulnerability.


  • CVE-2018-8629 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the failure to handle objects in memory by the Chakra scripting engine in Microsoft Edge. Attackers looking to exploit this vulnerability must convince a user to visit a specially crafted website that hosts the exploit to this vulnerability.


  • CVE-2018-8643 - Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Important

    This remote code execution vulnerability in the scripting engine in Internet Explorer is resolved by this patch. Attackers looking to exploit this vulnerability must convince a user to visit a specially crafted website that hosts the exploit to this vulnerability.


  • CVE-2018-8625 - Windows VBScript Engine Remote Code Execution Vulnerability
    Risk Rating: Important

    This remote code execution vulnerability exists in the handling of objects in memory by the VBScript engine in Windows. This handling is corrected by this specific patch.


  • CVE-2018-8634 - Microsoft Text-To-Speech Remote Code Execution Vulnerability
    Risk Rating: Critical

    The remote code execution vulnerability exists in the improper handling of objects in memory by the Microsoft text-to-speech in Windows. This handling is corrected by this specific patch.


  • CVE-2018-8628 - Microsoft PowerPoint Remote Code Execution Vulnerability
    Risk Rating: Important

    This remote code execution vulnerability exists in the improper handling of objects in memory by Microsoft PowerPoint. This handling is corrected by this specific patch.


  • CVE-2018-8583 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the improper handling of objects in memory by the Chakra scripting engine in Microsoft Edge. This handling is corrected by this specific patch.


  • CVE-2018-8618 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the improper access of objects in memory by the Chakra scripting engine in Microsoft Edge. This handling is corrected by this specific patch.


  • CVE-2018-8587 - Microsoft Outlook Remote Code Execution Vulnerability
    Risk Rating: Important

    This remote code execution vulnerability exists in the improper access of objects in memory by Microsoft Outlook. This handling is corrected by this specific patch.


  • CVE-2018-8617 - Chakra Scripting Engine Memory Corruption Vulnerability
    Risk Rating: Critical

    This remote code execution vulnerability exists in the improper access of objects in memory by the Chakra scripting engine in Microsoft Edge. This handling is corrected by this specific patch.


  • CVE-2018-8619 - Internet Explorer Remote Code Execution Vulnerability
    Risk Rating: Important

    This remote code execution vulnerability exists in the improper restricting of VBScript Internet Explorer VBScript execution policy under specific conditions. This handling is corrected by this specific patch.


  TREND MICRO PROTECTION INFORMATION

Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using the Vulnerability Protection product or OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities.

Vulnerability ID DPI Rule Number DPI Rule Name Release Date Vulnerability Protection Compatibility
CVE-2018-8583 1009409 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2018-8583) 12-Dec-18 YES
CVE-2018-8617 1009411 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2018-8617) 12-Dec-18 YES
CVE-2018-8618 1009412 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2018-8618) 12-Dec-18 YES
CVE-2018-8619 1009410 Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2018-8619) 12-Dec-18 YES
CVE-2018-8624 1009416 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2018-8624) 12-Dec-18 YES
CVE-2018-8629 1009415 Microsoft Edge Chakra Scripting Engine Memory Corruption Vulnerability (CVE-2018-8629) 12-Dec-18 YES
CVE-2018-8631 1009414 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2018-8631) 12-Dec-18 YES
CVE-2018-8634 1009413 Microsoft Text-To-Speech Remote Code Execution Vulnerability (CVE-2018-8634) 12-Dec-18 YES
CVE-2018-8628 1009427 Microsoft PowerPoint Remote Code Execution Vulnerability (CVE-2018-8628) 12-Dec-18 YES
CVE-2018-8587 1009428 Microsoft Outlook Remote Code Execution Vulnerability (CVE-2018-8587) 12-Dec-18 YES
CVE-2018-8611, CVE-2018-8639 1009431 Microsoft Windows Multiple Security Vulnerabilities (Dec-2018) 12-Dec-18 YES
CVE-2018-8643 1009429 Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2018-8643) 12-Dec-18 YES
CVE-2018-8625 1009430 Microsoft Internet Explorer Remote Code Execution Vulnerability (CVE-2018-8625) 12-Dec-18 YES

Featured Stories