Alert: Reported Microsoft Vulnerabilities
Posted by Kian Ng on 14 May 2018 05:15 PM
Dear users of Microsoft Windows Servers,
1. The first, CVE-2018-8174, is a critical Remote Code Execution (RCE) vulnerability. Also dubbed as "Double Kill", which is a violated attempt to access memory after it has been freed. The issue resides in the way the VBScript Engine (included in all currently supported versions of Windows) handles objects in computer memory, corrupting memory in such a way that an attacker could execute arbitrary code in the context of the current user. This flaw allows an attacker to remotely take control of an affected system. The exploit could be delivered through malicious Office documents or links in emails that force the URL contents to be loaded in Internet Explorer.
2. The second, CVE-2018-8120 is a privilege-escalation flaw that occurred in the Win32k component of Windows when it fails to properly handle objects in computer memory. To exploit this vulnerability, an attacker would first have to gain access to the system. This could be achieved by tricking the recipient to open malicious Office documents sent via email, allowing an attacker to remotely take control of an affected system.
Affected Versions include:
All currently supported versions of Windows, including: