Windows Kernel Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

.NET Framework Information Disclosure Vulnerability

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.

Remote Desktop Protocol Client Information Disclosure Vulnerability

Windows HTML Platforms Security Feature Bypass Vulnerability

Windows ALPC Elevation of Privilege Vulnerability

Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability

TPM Device Driver Information Disclosure Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Scripting Engine Memory Corruption Vulnerability

Windows Network File System Remote Code Execution Vulnerability

Windows Network File System Denial of Service Vulnerability

Windows KernelStream Information Disclosure Vulnerability

Windows Print Spooler Remote Code Execution Vulnerability

Win32k Elevation of Privilege Vulnerability

Windows Function Discovery SSDP Provider Information Disclosure Vulnerability

Windows Canonical Display Driver Information Disclosure Vulnerability

<p>An information disclosure vulnerability exists when the .NET Framework improperly handles objects in memory. An attacker who successfully exploited the vulnerability could disclose contents of an affected system's memory.</p> <p>To exploit the vulnerability, an authenticated attacker would need to run a specially crafted application.</p> <p>The update addresses the vulnerability by correcting how the .NET Framework handles objects in memory.</p>

<p>An elevation of privilege vulnerability exists in the Windows Installer when the Windows Installer fails to properly sanitize input leading to an insecure library loading behavior.</p> <p>A locally authenticated attacker could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p> <p>The security update addresses the vulnerability by correcting the input sanitization error to preclude unintended elevation.</p>