Patch Tuesday, February 2020
Microsoft's monthly security release, Tuesday, February 11, 2020. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
4 CVEs · 1 critical · 4 exploited · 4 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
4 CVEs · 1 critical · 4 exploited · 4 with public exploit code
- 9.8CriticalFeb 11, 2020Microsoft SQL Server DeserializationCVE-2020-0618Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.Exploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
- 8.8HighFeb 11, 2020Microsoft Exchange Server Auth bypass / access controlCVE-2020-0688Microsoft Exchange Server An attacker gains arbitrary code execution Patch and update Microsoft Exchange Server to the latest version.Exploited100% likelyExploit codeExploit-DB · MetasploitDetection
- 7.8HighFeb 11, 2020Microsoft Windows Path traversal / file handlingCVE-2020-0683Microsoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files.Exploited7.6% likelyExploit codeExploit-DB
- 7.5HighFeb 11, 2020Microsoft Internet Explorer 10 Memory corruptionCVE-2020-0674A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713, CVE-2020-076Exploited87% likelyExploit codeExploit-DB
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.