Patch Tuesday, April 2020
Microsoft's monthly security release, Tuesday, April 14, 2020. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
4 CVEs · 0 critical · 4 exploited · 1 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
4 CVEs · 0 critical · 4 exploited · 1 with public exploit code
- 8.8HighApr 15, 2020Microsoft Windows Memory corruptionCVE-2020-1020Windows systems with Adobe Font Manager Library installed are affected. An attacker gains arbitrary code execution and potentially elevated privileges. Update Windows to the latest version with the security patch applied.Exploited65% likelyExploit code
- 7.8HighApr 15, 2020Microsoft Windows Memory corruptionCVE-2020-09381. An attacker can exploit the vulnerability in the Adobe Font Manager Library on Microsoft Windows systems. 2. An attacker gains remote code execution, potentially leading to arbitrary code execution and system compromise. 3. Apply the relevant security patch provided by Microsoft to remediate the vulnerability.Exploited69% likely
- 7.8HighApr 15, 2020Microsoft Windows Memory corruptionCVE-2020-1027An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.Exploited4.7% likely
- 7.5HighApr 15, 2020Microsoft Internet Explorer Memory corruptionCVE-2020-0968Microsoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.Exploited31% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.