Security Windows 10 April 2018 Security Updates

eva2000 · Apr 11, 2018

Looks like quite a few Windows 10 April 2018 security updates are relevant to us as well It's April 2018 – and Patch Tuesday shows Windows security is still foiled by fiendish fonts

some include attacking our PCs through malicious fonts loaded on a web page !

Among the more serious bugs are a set of five remote code execution vulnerabilities in the graphics component of Windows and Windows Server (CVE-2018-1010, CVE-2018-1012, CVE-2018-1013, CVE-2018-1015, CVE-2018-1016). Each of those vulnerabilities would allow an attacker to pwn PCs via a specially-crafted font, in some cases by simply putting the font on a web page viewed by the target.
Click to expand...

MITRE CVE-2018-1010

A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploited the vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

There are multiple ways an attacker could exploit the vulnerability:

In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability and then convince users to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email or instant message that takes users to the attacker's website, or by opening an attachment sent through email.

In a file-sharing attack scenario, an attacker could provide a specially crafted document file designed to exploit the vulnerability and then convince users to open the document file.

The security update addresses the vulnerability by correcting how the Windows font library handles embedded fonts.
Click to expand...

recording keystrokes on Wireless 850 keyboards !

Microsoft even snuck in a hardware fix to the April updates. The patch load includes a fix for the Wireless 850 Keyboard to address a particularly nasty bug CVE-2018-8117 that lets an attacker bypass security checks with an old AES and record keystrokes or hijack and inject packets sent from the wireless keyboard to the PC.
Click to expand...

They include an update to Flash Player that patches three remote code execution vulnerabilties and three information disclosure flaws. Microsoft has issued its own patch for the Internet Explorer version of Flash Player.
Click to expand...

eva2000 · Apr 12, 2018

Related Using Outlook? You should probably do some patching

Microsoft emitted a patch for all supported versions of Outlook on Patch Tuesday to prevent attackers harvesting credentials from users who simply preview a carefully crafted Rich Text (RTF) email.

The vulnerability (CVE-2018-0950) exploited Outlook’s unfortunate habit of retrieving remotely hosted Object Linking and Embedding (OLE) content when previewing a RTF email.
Click to expand...

Log in / Register

Forums

Discover Centmin Mod today

Security Windows 10 April 2018 Security Updates

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Discover Centmin Mod today

Security Windows 10 April 2018 Security Updates

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.