【漏洞详情】
微软已发布2019年07月安全补丁,修复了79个从简单的欺骗攻击到远程执行代码的安全问题,涉及产品 Microsoft Windows、Internet Explorer、SQL Server、ASP.NET等,其中包含 16个严重漏洞,攻击者可利用此类漏洞进行远程代码执行、内存破坏等攻击,修复的漏洞详细列表如下,请用户综合评估业务影响,并选择安排补丁升级:
序号 |
产品 |
CVE 编号 |
CVE 标题 |
严重程度 |
1 |
.NET Framework |
CVE-2019-1113 |
.NET Framework 远程代码执行漏洞 |
Critical |
2 |
.NET Framework |
CVE-2019-1006 |
WCF/WIF SAML Token Authentication Bypass Vulnerability |
Important |
3 |
.NET Framework |
CVE-2019-1083 |
.NET 拒绝服务漏洞 |
Important |
4 |
ASP.NET |
CVE-2019-1075 |
ASP.NET Core 欺骗漏洞 |
Moderate |
5 |
Azure |
CVE-2019-0962 |
Azure Automation 特权提升漏洞 |
Important |
6 |
Azure DevOps |
CVE-2019-1072 |
Azure DevOps Server and Team Foundation Server 远程代码执行漏洞 |
Critical |
7 |
Azure DevOps |
CVE-2019-1076 |
Team Foundation Server Cross-site Scripting Vulnerability |
Important |
8 |
Internet Explorer |
CVE-2019-1063 |
Internet Explorer 内存破坏漏洞 |
Critical |
9 |
Microsoft Browsers |
CVE-2019-1104 |
Microsoft Browser 内存破坏漏洞 |
Critical |
10 |
Microsoft Exchange Server |
CVE-2019-1136 |
Microsoft Exchange Server 特权提升漏洞 |
Important |
11 |
Microsoft Exchange Server |
CVE-2019-1137 |
Microsoft Exchange Server 欺骗漏洞 |
Important |
12 |
Microsoft Exchange Server |
ADV190021 |
Outlook on the web 跨站脚本漏洞 |
Important |
13 |
Microsoft Graphics Component |
CVE-2019-1093 |
DirectWrite 信息泄露漏洞 |
Important |
14 |
Microsoft Graphics Component |
CVE-2019-1094 |
Windows GDI 信息泄露漏洞 |
Important |
15 |
Microsoft Graphics Component |
CVE-2019-1095 |
Windows GDI 信息泄露漏洞 |
Important |
16 |
Microsoft Graphics Component |
CVE-2019-1096 |
Win32k 信息泄露漏洞 |
Important |
17 |
Microsoft Graphics Component |
CVE-2019-1097 |
DirectWrite 信息泄露漏洞 |
Important |
18 |
Microsoft Graphics Component |
CVE-2019-1098 |
Windows GDI 信息泄露漏洞 |
Important |
19 |
Microsoft Graphics Component |
CVE-2019-1100 |
Windows GDI 信息泄露漏洞 |
Important |
20 |
Microsoft Graphics Component |
CVE-2019-1101 |
Windows GDI 信息泄露漏洞 |
Important |
21 |
Microsoft Graphics Component |
CVE-2019-1102 |
GDI+ 远程代码执行漏洞 |
Critical |
22 |
Microsoft Graphics Component |
CVE-2019-1116 |
Windows GDI 信息泄露漏洞 |
Important |
23 |
Microsoft Graphics Component |
CVE-2019-1117 |
DirectWrite 远程代码执行漏洞 |
Important |
24 |
Microsoft Graphics Component |
CVE-2019-1118 |
DirectWrite 远程代码执行漏洞 |
Important |
25 |
Microsoft Graphics Component |
CVE-2019-1119 |
DirectWrite 远程代码执行漏洞 |
Important |
26 |
Microsoft Graphics Component |
CVE-2019-1120 |
DirectWrite 远程代码执行漏洞 |
Important |
27 |
Microsoft Graphics Component |
CVE-2019-1121 |
DirectWrite 远程代码执行漏洞 |
Important |
28 |
Microsoft Graphics Component |
CVE-2019-1122 |
DirectWrite 远程代码执行漏洞 |
Important |
29 |
Microsoft Graphics Component |
CVE-2019-1123 |
DirectWrite 远程代码执行漏洞 |
Important |
30 |
Microsoft Graphics Component |
CVE-2019-1124 |
DirectWrite 远程代码执行漏洞 |
Important |
31 |
Microsoft Graphics Component |
CVE-2019-1127 |
DirectWrite 远程代码执行漏洞 |
Important |
32 |
Microsoft Graphics Component |
CVE-2019-1128 |
DirectWrite 远程代码执行漏洞 |
Important |
33 |
Microsoft Graphics Component |
CVE-2019-0999 |
DirectX 特权提升漏洞 |
Important |
34 |
Microsoft Office |
CVE-2019-1109 |
Microsoft Office 欺骗漏洞 |
Important |
35 |
Microsoft Office |
CVE-2019-1110 |
Microsoft Excel 远程代码执行漏洞 |
Important |
36 |
Microsoft Office |
CVE-2019-1111 |
Microsoft Excel 远程代码执行漏洞 |
Important |
37 |
Microsoft Office |
CVE-2019-1112 |
Microsoft Excel 信息泄露漏洞 |
Important |
38 |
Microsoft Office |
CVE-2019-1084 |
Microsoft Exchange 信息泄露漏洞 |
Important |
39 |
Microsoft Office SharePoint |
CVE-2019-1134 |
Microsoft Office SharePoint XSS Vulnerability |
Important |
40 |
Microsoft Scripting Engine |
CVE-2019-1056 |
Scripting Engine 内存破坏漏洞 |
Critical |
41 |
Microsoft Scripting Engine |
CVE-2019-1059 |
Scripting Engine 内存破坏漏洞 |
Critical |
42 |
Microsoft Scripting Engine |
CVE-2019-1062 |
Chakra Scripting Engine 内存破坏漏洞 |
Critical |
43 |
Microsoft Scripting Engine |
CVE-2019-1092 |
Chakra Scripting Engine 内存破坏漏洞 |
Critical |
44 |
Microsoft Scripting Engine |
CVE-2019-1103 |
Chakra Scripting Engine 内存破坏漏洞 |
Critical |
45 |
Microsoft Scripting Engine |
CVE-2019-1106 |
Chakra Scripting Engine 内存破坏漏洞 |
Critical |
46 |
Microsoft Scripting Engine |
CVE-2019-1107 |
Chakra Scripting Engine 内存破坏漏洞 |
Critical |
47 |
Microsoft Scripting Engine |
CVE-2019-1001 |
Scripting Engine 内存破坏漏洞 |
Critical |
48 |
Microsoft Scripting Engine |
CVE-2019-1004 |
Scripting Engine 内存破坏漏洞 |
Critical |
49 |
Microsoft Windows |
CVE-2019-0865 |
SymCrypt 拒绝服务漏洞 |
Important |
50 |
Microsoft Windows |
CVE-2019-0887 |
Remote Desktop Services 远程代码执行漏洞 |
Important |
51 |
Microsoft Windows |
CVE-2019-0966 |
Windows Hyper-V 拒绝服务漏洞 |
Important |
52 |
Microsoft Windows |
CVE-2019-0975 |
ADFS 安全功能绕过漏洞 |
Important |
53 |
Microsoft Windows |
CVE-2019-1126 |
ADFS 安全功能绕过漏洞 |
Important |
54 |
Microsoft Windows |
CVE-2019-0785 |
Windows DHCP Server 远程代码执行漏洞 |
Critical |
55 |
Microsoft Windows |
CVE-2019-0880 |
Microsoft splwow64 特权提升漏洞 |
Important |
56 |
Microsoft Windows |
CVE-2019-1037 |
Windows Error Reporting 特权提升漏洞 |
Important |
57 |
Microsoft Windows |
CVE-2019-1067 |
Windows Kernel 特权提升漏洞 |
Important |
58 |
Microsoft Windows |
CVE-2019-1074 |
Microsoft Windows 特权提升漏洞 |
Important |
59 |
Microsoft Windows |
CVE-2019-1082 |
Microsoft Windows 特权提升漏洞 |
Important |
60 |
Microsoft Windows |
CVE-2019-1091 |
Microsoft unistore.dll 信息泄露漏洞 |
Important |
61 |
Microsoft Windows |
CVE-2019-1129 |
Windows 特权提升漏洞 |
Important |
62 |
Microsoft Windows |
CVE-2019-1130 |
Windows 特权提升漏洞 |
Important |
63 |
Microsoft Windows DNS |
CVE-2019-0811 |
Windows DNS Server 拒绝服务漏洞 |
Important |
64 |
Microsoft Windows DNS |
CVE-2019-1090 |
Windows dnsrlvr.dll 特权提升漏洞 |
Important |
65 |
Open Source Software |
CVE-2018-15664 |
Docker 特权提升漏洞 |
Important |
66 |
Servicing Stack Updates |
ADV990001 |
Latest Servicing Stack Updates |
Critical |
67 |
SQL Server |
CVE-2019-1068 |
Microsoft SQL Server 远程代码执行漏洞 |
Important |
68 |
Visual Studio |
CVE-2019-1077 |
Visual Studio 特权提升漏洞 |
Important |
69 |
Visual Studio |
CVE-2019-1079 |
Visual Studio 信息泄露漏洞 |
Important |
70 |
Windows Kernel |
CVE-2019-1071 |
Windows Kernel 信息泄露漏洞 |
Important |
71 |
Windows Kernel |
CVE-2019-1073 |
Windows Kernel 信息泄露漏洞 |
Important |
72 |
Windows Kernel |
CVE-2019-1089 |
Windows RPCSS 特权提升漏洞 |
Important |
73 |
Windows Kernel |
CVE-2019-1132 |
Win32k 特权提升漏洞 |
Important |
74 |
Windows Media |
CVE-2019-1085 |
Windows WLAN Service 特权提升漏洞 |
Important |
75 |
Windows Media |
CVE-2019-1086 |
Windows Audio Service 特权提升漏洞 |
Important |
76 |
Windows Media |
CVE-2019-1087 |
Windows Audio Service 特权提升漏洞 |
Important |
77 |
Windows Media |
CVE-2019-1088 |
Windows Audio Service 特权提升漏洞 |
Important |
78 |
Windows RDP |
CVE-2019-1108 |
Remote Desktop Protocol Client 信息泄露漏洞 |
Important |
79 |
Windows Shell |
CVE-2019-1099 |
Windows GDI 信息泄露漏洞 |
Important |
【风险评级】
高危
【影响范围】
7月安全发布的漏洞及补丁涉及组件如下:
.NET Framework
ASP.NET
Azure
Azure DevOps
Internet Explorer
Microsoft Browsers
Microsoft Exchange Server
Microsoft Graphics Component
Microsoft Office
Microsoft Office SharePoint
Microsoft Scripting Engine
Microsoft Windows
Microsoft Windows DNS
Open Source Software
Servicing Stack Updates
SQL Server
Visual Studio
Windows Kernel
Windows Media
Windows RDP
Windows Shell
【修复建议】
建议用户关注并依据实际业务评估漏洞风险影响,选择更新相关产品补丁,以提高系统安全性;
修复方法:打开 Windows Update 更新功能,点击“检查更新”按钮,依据业务需求下载安装相关安全补丁,安装完毕后重启系统,并检查系统运行情况。
【参考链接】
https://support.microsoft.com/en-us/help/20190709/security-update-deployment-information-july-9-2019
特别提醒:修复漏洞前请进行充分测试,并务必做好数据备份和快照,防止出现意外。
平安金融云
2019年7月10日