Patch Tuesday, November 2019
Microsoft's monthly security release, Tuesday, November 12, 2019. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
4 CVEs · 0 critical · 4 exploited · 3 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
4 CVEs · 0 critical · 4 exploited · 3 with public exploit code
- 7.8HighNov 12, 2019Microsoft Windows Privilege escalationCVE-2019-1388Microsoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.Exploited8.6% likelyExploit codeDetection
- 7.8HighNov 12, 2019Microsoft Windows Privilege escalationCVE-2019-1405A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.Exploited30% likelyExploit codeExploit-DB · Metasploit
- 7.5HighNov 12, 2019Microsoft Internet Explorer Memory corruptionCVE-2019-1429Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.Exploited77% likelyExploit codeExploit-DB
- 7.8HighNov 12, 2019Microsoft Windows Path traversal / file handlingCVE-2019-1385A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.Exploited3.6% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.