KLA11931 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, , obtain sensitive information, spoof user interface, cause denial of service.

Below is a complete list of vulnerabilities:

1. A memory corruption vulnerability in Media Foundation can be exploited remotely via specially crafted document to execute arbitrary code.
2. An elevation of privilege vulnerability in Windows Storage Service can be exploited remotely via specially crafted application to gain privileges.
3. An elevation of privilege vulnerability in Windows Work Folder Service can be exploited remotely via specially crafted application to gain privileges.
4. An elevation of privilege vulnerability in Windows Runtime can be exploited remotely via specially crafted application to gain privileges.
5. An elevation of privilege vulnerability in Windows CDP User Components can be exploited remotely via specially crafted application to gain privileges.
6. An elevation of privilege vulnerability in Windows Backup Engine can be exploited remotely via specially crafted application to gain privileges.
7. An elevation of privilege vulnerability in Windows WalletService can be exploited remotely via specially crafted application to gain privileges.
8. A remote code execution vulnerability in Jet Database Engine can be exploited remotely via specially crafted file to execute arbitrary code.
9. An elevation of privilege vulnerability in Windows Kernel can be exploited remotely via specially crafted application to gain privileges.
10. Security vulnerability in Windows can be exploited to bypass security restrictions and cause denial of service.
11. An elevation of privilege vulnerability in Windows CSC Service can be exploited remotely via specially crafted application to gain privileges.
12. An elevation of privilege vulnerability in Windows Work Folders Service can be exploited remotely via specially crafted application to gain privileges.
13. An information disclosure vulnerability in Windows Image Acquisition Service can be exploited remotely via specially crafted application to obtain sensitive information.
14. An information disclosure vulnerability in Media Foundation can be exploited remotely via specially crafted file to obtain sensitive information.
15. An elevation of privilege vulnerability in Windows GDI can be exploited remotely via specially crafted application to gain privileges.
16. An elevation of privilege vulnerability in Windows can be exploited remotely via specially crafted application to gain privileges.
17. A remote code execution vulnerability in Microsoft Graphics Components can be exploited remotely via specially crafted file to execute arbitrary code.
18. A remote code execution vulnerability in Microsoft Windows Codecs Library can be exploited remotely via specially crafted image to execute arbitrary code.
19. An information disclosure vulnerability in Windows Kernel can be exploited remotely via specially crafted application to obtain sensitive information.
20. An elevation of privilege vulnerability in Windows Function Discovery SSDP Provider can be exploited remotely via specially crafted application to gain privileges.
21. An elevation of privilege vulnerability in Windows Setup can be exploited remotely to gain privileges.
22. An information disclosure vulnerability in DirectWrite can be exploited remotely via specially crafted document to obtain sensitive information.
23. An elevation of privilege vulnerability in Netlogon can be exploited remotely via specially crafted application to gain privileges.
24. An elevation of privilege vulnerability in Windows Server Resource Management Service can be exploited remotely via specially crafted application to gain privileges.
25. An elevation of privilege vulnerability in DirectX can be exploited remotely via specially crafted application to gain privileges.
26. An elevation of privilege vulnerability in Windows dnsrslvr.dll can be exploited remotely via specially crafted application to gain privileges.
27. An elevation of privilege vulnerability in Windows Ancillary Function Driver for WinSock can be exploited remotely via specially crafted application to gain privileges.
28. A remote code execution vulnerability in Windows Media can be exploited remotely via specially crafted document to execute arbitrary code.
29. An elevation of privilege vulnerability in Windows Print Spooler can be exploited remotely via specially crafted script to gain privileges.
30. An elevation of privilege vulnerability in Local Security Authority Subsystem Service can be exploited remotely via specially crafted authentication to gain privileges.
31. An elevation of privilege vulnerability in Windows Hard Link can be exploited remotely via specially crafted application to gain privileges.
32. A spoofing vulnerability in Windows can be exploited remotely to spoof user interface.
33. An information disclosure vulnerability in Windows RRAS Service can be exploited remotely via specially crafted application to obtain sensitive information.
34. An information disclosure vulnerability in Windows ARM can be exploited remotely via specially crafted application to obtain sensitive information.
35. An elevation of privilege vulnerability in Windows File Server Resource Management Service can be exploited remotely via specially crafted application to gain privileges.
36. An elevation of privilege vulnerability in Windows UPnP Device Host can be exploited remotely via specially crafted application to gain privileges.
37. An elevation of privilege vulnerability in Windows Telephony Server can be exploited remotely via specially crafted application to gain privileges.
38. An information disclosure vulnerability in Windows State Repository Service can be exploited remotely via specially crafted application to obtain sensitive information.
39. An information disclosure vulnerability in Win32k can be exploited remotely via specially crafted application to obtain sensitive information.
40. An elevation of privilege vulnerability in Connected User Experiences and Telemetry Service can be exploited remotely via specially crafted application to gain privileges.
41. An elevation of privilege vulnerability in Windows Radio Manager API can be exploited remotely via specially crafted application to gain privileges.
42. An elevation of privilege vulnerability in Windows Speech Runtime can be exploited remotely via specially crafted application to gain privileges.
43. A remote code execution vulnerability in Windows Font Driver Host can be exploited remotely to execute arbitrary code.
44. An elevation of privilege vulnerability in Windows Custom Protocol Engine can be exploited remotely via specially crafted application to gain privileges.
45. An elevation of privilege vulnerability in Windows Network Connection Broker can be exploited remotely via specially crafted application to gain privileges.
46. An elevation of privilege vulnerability in Windows Speech Shell Components can be exploited remotely via specially crafted application to gain privileges.
47. An elevation of privilege vulnerability in Windows Backup Service can be exploited remotely via specially crafted application to gain privileges.
48. An elevation of privilege vulnerability in Windows Remote Access can be exploited remotely via specially crafted application to gain privileges.
49. An elevation of privilege vulnerability in Windows Accounts Control can be exploited remotely via specially crafted application to gain privileges.
50. A denial of service vulnerability in Windows Remote Desktop Gateway (RD Gateway) can be exploited remotely via specially crafted requests to cause denial of service.
51. An elevation of privilege vulnerability in Windows Registry can be exploited remotely via specially crafted application to gain privileges.
52. An information disclosure vulnerability in Windows WaasMedic Service can be exploited remotely via specially crafted application to obtain sensitive information.

Original advisories

CVE-2020-1492

CVE-2020-1490

CVE-2020-1552

CVE-2020-1553

CVE-2020-1550

CVE-2020-1551

CVE-2020-1556

CVE-2020-1557

CVE-2020-1554

CVE-2020-1558

CVE-2020-1417

CVE-2020-1488

CVE-2020-1489

CVE-2020-1484

CVE-2020-1485

CVE-2020-1486

CVE-2020-1487

CVE-2020-1480

CVE-2020-1566

CVE-2020-1565

CVE-2020-1564

CVE-2020-1562

CVE-2020-1561

CVE-2020-1560

CVE-2020-1578

CVE-2020-1579

CVE-2020-1571

CVE-2020-1574

CVE-2020-1577

CVE-2020-1470

CVE-2020-1473

CVE-2020-1472

CVE-2020-1475

CVE-2020-1474

CVE-2020-1477

CVE-2020-1479

CVE-2020-1478

CVE-2020-1585

CVE-2020-1584

CVE-2020-1587

CVE-2020-1339

CVE-2020-1337

CVE-2020-1509

CVE-2020-1467

CVE-2020-1464

CVE-2020-1383

CVE-2020-1459

CVE-2020-1518

CVE-2020-1519

CVE-2020-1516

CVE-2020-1517

CVE-2020-1515

CVE-2020-1512

CVE-2020-1513

CVE-2020-1510

CVE-2020-1511

CVE-2020-1529

CVE-2020-1528

CVE-2020-1522

CVE-2020-1521

CVE-2020-1520

CVE-2020-1527

CVE-2020-1526

CVE-2020-1525

CVE-2020-1524

CVE-2020-1534

CVE-2020-1535

CVE-2020-1536

CVE-2020-1537

CVE-2020-1530

CVE-2020-1531

CVE-2020-1533

CVE-2020-1466

CVE-2020-1538

CVE-2020-1539

CVE-2020-1377

CVE-2020-1378

CVE-2020-1379

CVE-2020-1541

CVE-2020-1540

CVE-2020-1543

CVE-2020-1542

CVE-2020-1545

CVE-2020-1544

CVE-2020-1547

CVE-2020-1546

CVE-2020-1549

CVE-2020-1548

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Windows

Microsoft-Windows-Server

Microsoft-Windows-Server-2012

Microsoft-Windows-8

Microsoft-Windows-7

Microsoft-Windows-Server-2008

Windows-RT

Microsoft-Windows-10

CVE list

CVE-2020-1488 high

CVE-2020-1379 high

CVE-2020-1537 critical

CVE-2020-1383 high

CVE-2020-1475 critical

CVE-2020-1545 critical

CVE-2020-1579 critical

CVE-2020-1470 critical

CVE-2020-1536 critical

CVE-2020-1577 critical

CVE-2020-1552 critical

CVE-2020-1535 critical

CVE-2020-1473 high

CVE-2020-1551 critical

CVE-2020-1530 critical

CVE-2020-1474 critical

CVE-2020-1518 critical

CVE-2020-1519 critical

CVE-2020-1516 critical

CVE-2020-1478 critical

CVE-2020-1558 critical

CVE-2020-1515 critical

CVE-2020-1538 critical

CVE-2020-1539 critical

CVE-2020-1557 high

CVE-2020-1554 critical

CVE-2020-1472 high

CVE-2020-1517 critical

CVE-2020-1484 critical

CVE-2020-1485 high

CVE-2020-1486 critical

CVE-2020-1544 critical

CVE-2020-1529 critical

CVE-2020-1584 critical

CVE-2020-1587 critical

CVE-2020-1377 critical

CVE-2020-1477 high

CVE-2020-1339 critical

CVE-2020-1337 critical

CVE-2020-1378 critical

CVE-2020-1564 critical

CVE-2020-1562 critical

CVE-2020-1513 critical

CVE-2020-1541 critical

CVE-2020-1540 critical

CVE-2020-1543 critical

CVE-2020-1542 critical

CVE-2020-1534 critical

CVE-2020-1467 critical

CVE-2020-1464 critical

CVE-2020-1546 critical

CVE-2020-1547 critical

CVE-2020-1520 critical

CVE-2020-1489 critical

CVE-2020-1492 critical

CVE-2020-1490 critical

CVE-2020-1553 critical

CVE-2020-1550 critical

CVE-2020-1556 critical

CVE-2020-1417 high

CVE-2020-1487 critical

CVE-2020-1480 critical

CVE-2020-1566 warning

CVE-2020-1565 critical

CVE-2020-1561 critical

CVE-2020-1560 critical

CVE-2020-1578 warning

CVE-2020-1571 high

CVE-2020-1574 high

CVE-2020-1479 critical

CVE-2020-1585 critical

CVE-2020-1509 critical

CVE-2020-1459 critical

CVE-2020-1512 critical

CVE-2020-1510 high

CVE-2020-1511 critical

CVE-2020-1528 critical

CVE-2020-1522 critical

CVE-2020-1521 critical

CVE-2020-1527 critical

CVE-2020-1526 critical

CVE-2020-1525 critical

CVE-2020-1524 critical

CVE-2020-1531 critical

CVE-2020-1533 critical

CVE-2020-1466 critical

CVE-2020-1549 critical

CVE-2020-1548 critical

KB list

4571692

4571694

4571709

4566782

4571723

4571703

4565349

4571741

4565351

4578013

4601319

4601315

4601345

4601318

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)Windows 10 Version 1809 for ARM64-based SystemsWindows 10 Version 1709 for ARM64-based SystemsWindows 8.1 for x64-based systemsWindows RT 8.1Windows Server, version 2004 (Server Core installation)Windows 10 Version 1709 for x64-based SystemsWindows Server 2008 R2 for x64-based Systems Service Pack 1Windows 10 Version 1809 for 32-bit SystemsWindows Server 2016 (Server Core installation)Windows 10 Version 1803 for ARM64-based SystemsWindows 10 for x64-based SystemsWindows 10 Version 1903 for 32-bit SystemsWindows 10 Version 1803 for x64-based SystemsWindows 10 Version 1909 for x64-based SystemsWindows 10 Version 1607 for 32-bit SystemsWindows 10 Version 1607 for x64-based SystemsWindows 10 Version 1803 for 32-bit SystemsWindows Server 2012 R2 (Server Core installation)Windows 10 Version 2004 for ARM64-based SystemsWindows Server 2008 for x64-based Systems Service Pack 2Windows 10 Version 2004 for x64-based SystemsWindows 8.1 for 32-bit systemsWindows Server 2012 R2Windows 10 Version 1909 for 32-bit SystemsWindows 10 for 32-bit SystemsWindows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)Windows Server, version 1909 (Server Core installation)Windows 10 Version 1709 for 32-bit SystemsWindows Server 2016Windows Server 2008 for 32-bit Systems Service Pack 2Windows Server 2019Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)Windows Server 2012 (Server Core installation)Windows 10 Version 1809 for x64-based SystemsWindows 10 Version 2004 for 32-bit SystemsWindows 10 Version 1909 for ARM64-based SystemsWindows Server 2012Windows 7 for x64-based Systems Service Pack 1Windows 10 Version 1903 for x64-based SystemsWindows 10 Version 1903 for ARM64-based SystemsWindows 7 for 32-bit Systems Service Pack 1Windows Server 2019 (Server Core installation)Windows Server, version 1903 (Server Core installation)