December 2018 Security Update from Microsoft – A Closer Look

Microsoft has recently rolled out the last patches of this year; December 2018 Security Update. In addition, Advisory on .NET Framework, ChackraCore, Microsoft Windows, Internet Explorer (IE), Edge, Office and Microsoft Office Services and Web Apps is released. Out of the 39 CVEs (Common Vulnerabilities and Exposure), the severity status of 9 is critical, while 30 CVEs are marked important. One of the bugs is reported to be under active attack in the Advisory.

In short, though the patch is a comparatively smaller one with just 39 CVEs, it is something you must prioritize. So, here, let’s take you through a brief review of the December 2018 Security Update Microsoft.

December 2018 Security Update from Microsoft

December 2018 Security Update from Microsoft

The update released on 11th December 2018 (Patch Tuesday, December) is a cumulative update. The patch consists of security updates as well as all the other fixed introduced until then. You system downloads these updates automatically. If you’d like to get the stand-alone version, you can download from Microsoft Update Catalog as well.

Threats and vulnerabilities

About 25 percent of the entire release relates to browser-related bugs. Office and Office SharePoint group of application constitute to another major part of the release. Some other important patches include those for the Kernel, DirectX and other kernel-mode drivers.

Of the 39 patches released as the 2018 December security update, the following are some of the important bugs covered.

CVE-2018-8517 – .NET Framework Denial of Service Vulnerability

This bug results in .NET framework being unable to handle some web requests appropriately. When exploited, this vulnerability may result in denial of service in a web application. It is possible for an attacker to exploit this bug without any kind of authentication. Some changes are brought in, so as to handle the .NET framework denial of service vulnerabilities.

CVE-2018-8611 – Windows Kernel Elevation of Privilege Vulnerability

This vulnerability relates to Windows Kernel’s inability to handle objects in its memory. If exploited, an attacker may run specific codes arbitrarily to change data, create an account or install programs with complete user privilege. In accordance with reports, this vulnerability is already being actively exploited.

CVE-2018-8634 – Microsoft Text-To-Speech Remote Code Execution Vulnerability

This patch can be important for those who employ or use text to speech. Though the chances of attacks are sleek, vulnerabilities exist as text-to-speech involves sending an HTTP POST request to the “Speech service”. And, like in case of Elevation of Privilege threat, when exploited, the invader can take control over the system affected.

CVE-2018-8540 – .NET Framework Remote Code Injection Vulnerability

Classified ‘critical’ under severity status, RCI vulnerability involves the failure of the .NET network to correctly validate the input. When exploited, the attacker can manipulate the affected system by using susceptible .NET methods to pass a particular code or input.

Follow the entire list of CVEs –

Used abbreviations –

RCI: “Remote Code Injection”
EMC: “Engine Memory Corruption”
RCE: “Remote Code Execution”
DOS: “Denial of Service”.

A closer look at December 2018 Security Updates from Microsoft details and the complete list of CVEs in the Advisory –

Vulnerability/TitleSeverity statusTypePublicXI – LatestXI – Older Exploited
CVE-2018-8611 –

Windows Kernel: Elevation of Privilege Vulnerability

ImportantEoPNo10Yes
CVE-2018-8540 -.

NET Framework RCI Vulnerability

CriticalRCENo22No
CVE-2018-8583 –

Chakra Scripting EMC Vulnerability

CriticalRCENo1NANo
CVE-2018-8617 –

Chakra Scripting EMC Vulnerability

CriticalRCENo1NANo
CVE-2018-8629 –

Chakra Scripting EMC Vulnerability

CriticalRCENo1NANo
CVE-2018-8626 –

Windows DNS Server-Heap Overflow Vulnerability

CriticalRCENo22No
CVE-2018-8624 –

Chakra Scripting EMC Vulnerability

CriticalRCENo1NANo
CVE-2018-8618 –

Chakra Scripting EMC Vulnerability

CriticalRCENo1NANo
CVE-2018-8634 –

Microsoft Text-To-Speech RCE Vulnerability

CriticalRCENo11No
CVE-2018-8631 –

Internet Explorer Memory Corruption Vulnerability

CriticalRCENo11No
CVE-2018-8517 –

.NET Framework DOS Vulnerability

ImportantDoSYes33No
CVE-2018-8514 –

Remote Procedure Call runtime Information Disclosure Vulnerability

ImportantInfoNo22No
CVE-2018-8477 –

Windows Kernel Information Disclosure Vulnerability

ImportantInfoNo11No
CVE-2018-8587 –

Microsoft Outlook RCE Vulnerability

ImportantRCENo11No
CVE-2018-8580 –

Microsoft SharePoint Information Disclosure Vulnerability

ImportantInfoNo33No
CVE-2018-8596 –

Windows GDI Information Disclosure Vulnerability

ImportantInfoNo11No
CVE-2018-8595 –

Windows GDI Information Disclosure Vulnerability

ImportantInfoNo11No
CVE-2018-8598 –

Microsoft Excel Information Disclosure Vulnerability

ImportantInfoNo22No
CVE-2018-8597 –

Microsoft Excel RCE Vulnerability

ImportantRCENo11No
CVE-2018-8604 –

Microsoft Exchange Server Tampering Vulnerability

ImportantTamperingNo22No
CVE-2018-8599 –

Diagnostics Hub Standard Collector Service Elevation of Privilege Vulnerability

ImportantEoPNo11No
CVE-2018-8619 –

Internet Explorer RCE Vulnerability

ImportantRCENo11No
CVE-2018-8612 –

Connected User Experiences and Telemetry Service DOS Vulnerability

ImportantDosNo11No
CVE-2018-8621 –

Windows Kernel Information Disclosure Vulnerability

ImportantInfoNo1NANo
CVE-2018-8625 –

Windows VBScript Engine RCE Vulnerability

ImportantRCENo11No
CVE-2018-8622 –

Windows Kernel Information Disclosure Vulnerability

ImportantInfoNo11No
CVE-2018-8628 –

Microsoft PowerPoint RCE Vulnerability

ImportantRCENo11No
CVE-2018-8627 –

Microsoft Excel Information Disclosure Vulnerability

ImportantInfoNo22No
CVE-2018-8635 –

Microsoft SharePoint Server Elevation of Privilege Vulnerability

ImportantInfoNo22No
CVE-2018-8639 –

Win32k Elevation of Privilege Vulnerability

ImportantEoPNo11No
CVE-2018-8636 –

Microsoft Excel RCE Vulnerability

ImportantRCENo22No
CVE-2018-8638 –

DirectX Information Disclosure Vulnerability

ImportantInfoNo11No
CVE-2018-8637 –

Win32k Information Disclosure Vulnerability

ImportantInfoNo11No
CVE-2018-8641 –

Win32k Elevation of Privilege Vulnerability

ImportantEopNo11No
CVE-2018-8643 –

Scripting EMC Vulnerability

ImportantRCENo11No
CVE-2018-8649 –

Windows DOS Vulnerability

ImportantDoSNoNANANo
CVE-2018-8650 –

Microsoft Office SharePoint XSS Vulnerability

ImportantXSSNoNANANo
CVE-2018-8652 –

Windows Azure Pack Cross-Site Scripting Vulnerability

ImportantXSSNoNANANo
CVE-2018-8651 –

Microsoft Dynamics NAV Cross-Site Scripting Vulnerability

ImportantXSSNo22No

That’s all!!!

   
 
About Sunita
Avatar for Sunita
Love to play with Windows 10. Suggestion - Going for Registry change or system files edit then remember to take a backup or create a restore point before Starting.

Leave a Reply

Your email address will not be published. Required fields are marked *