Patch Tuesday, December 2018
Microsoft's monthly security release, Tuesday, December 11, 2018. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 0 critical · 2 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 0 critical · 2 exploited · 2 with public exploit code
- 8.4HighDec 12, 2018Microsoft Windows Denial of serviceCVE-2018-8639Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.Exploited22% likelyExploit code
- 7.8HighDec 12, 2018Microsoft Windows Denial of serviceCVE-2018-8611A privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.Exploited4.2% likelyExploit code
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.