CVE-2018-0824

Опубликовано: 09 мая 2018

Источник: nvd

CVSS3: 8.8

CVSS3: 7.5

CVSS2: 5.1

EPSS Высокий

Описание

A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Ссылки

http://www.securityfocus.com/bid/104030
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040848
Broken Link
Third Party Advisory
VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0824
Patch
Vendor Advisory
https://www.exploit-db.com/exploits/44906/
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/104030
Broken Link
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040848
Broken Link
Third Party Advisory
VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0824
Patch
Vendor Advisory
https://www.exploit-db.com/exploits/44906/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:microsoft:windows_10_1507:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.8545

Высокий

8.8 High

CVSS3

7.5 High

CVSS3

5.1 Medium

CVSS2

Дефекты

CWE-502

Связанные уязвимости

CVE-2018-0824

CVSS3: 7.5

msrc

около 7 лет назад

Microsoft COM for Windows Remote Code Execution Vulnerability

GHSA-6w8g-777w-9mcc

CVSS3: 7.5

github

около 3 лет назад

EPSS

Процентиль: 99%

0.8545

Высокий

8.8 High

CVSS3

7.5 High

CVSS3

5.1 Medium

CVSS2

Дефекты

CWE-502