Patch Tuesday, September 2019
Microsoft's monthly security release, Tuesday, September 10, 2019. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
4 CVEs · 0 critical · 4 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
4 CVEs · 0 critical · 4 exploited · 2 with public exploit code
- 7.8HighSep 11, 2019Microsoft Windows Privilege escalationCVE-2019-1215Windows Win32k.sys kernel-mode driver. An attacker gains elevated privileges. Patch Windows with latest security updates.Exploited19% likelyExploit codeExploit-DB
- 7.8HighSep 11, 2019Microsoft Windows Path traversal / file handlingCVE-2019-1253A privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.Exploited12% likelyExploit codeExploit-DB
- 8.8HighSep 11, 2019Microsoft Excel Code / command injectionCVE-2019-1297A remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory.Exploited22% likely
- 7.8HighSep 11, 2019Microsoft Windows Memory corruptionCVE-2019-1214Microsoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.Exploited1.4% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.