Tripwire Patch Priority Index for June 2018

Image

Tripwire's June 2018 Patch Priority Index (PPI) brings together the top vulnerabilities from Microsoft and Adobe. First on the patch priority list this month are patches for Adobe Flash Player for Windows, Macintosh, Linux and Chrome OS. These Adobe Flash patches address type confusion, integer overflow, out-of-bounds read and stack-based buffer overflow vulnerabilities. Note that Adobe is aware of a report that an exploit for CVE-2018-5002 exists in the wild and has been used in targeted attacks against Windows users. Next on the patch priority list this month are patches for Microsoft Browsers, Edge and Scripting Engine. The patches for Internet Explorer resolve a security feature bypass vulnerability and two Memory Corruption vulnerabilities. The patches for Edge resolve memory corruption, information disclosure and security feature bypass vulnerabilities. Finally, the patches for Microsoft Scripting Engine address three memory corruption vulnerabilities, one of which is rated as a 1 on the Microsoft Exploitability Index (Exploitation More Likely). Up next are patches for Microsoft Excel, Office and Outlook. These patches address three elevation of privilege vulnerabilities along with an information disclosure vulnerability and a remote code execution vulnerability. Next are patches for Microsoft SharePiont that resolve two elevation of privilege vulnerabilities, followed by patches for Microsoft Windows. The June patch drop for Microsoft Windows contained patches for 23 vulnerabilities spread across Cortana; HIDParser; HTTP.sys; Media Foundationl; NTFS; Webdav; Win32k; Windows wireless network profile service; Hyper-V; GDI; DNSAPI; Kernel; and Desktop Bridge. These included elevation of privilege, denial of service, memory corruption, information disclosure, and remote code execution vulnerabilities. Last for the month are patches for Microsoft Device Guard, which resolve seven security feature bypass vulnerabilities. To learn more about Tripwire’s Vulnerability and Exposure Research Team (VERT), click here.