首页 > 安全研究 > 安全报告

中新网安安全研究院微软发布56个漏洞更新其中16个为“严重”并发布针对Meltdown及Spectre缓解措施报告

2018年1月，“微软周二补丁日（ms-tuesday）”，微软发布了针对各种产品已经识别和解决的漏洞涉及56个，其中16个评级为严重，39个评级为高危，1个评级为中危。这些漏洞影响ASP.NET，Edge，Internet Explorer，Office，Windows等等。

除了解决的56个漏洞之外，微软还发布了针对Meltdown和Spectre的更新。在ADV180002中针对Windows发布了针对这两个漏洞的缓解措施。请注意，由于与防病毒产品不兼容，用户和组织可能尚未收到此更新。欲了解更多信息，用户应参考微软的知识库涵盖这个问题的文章。


【Microsoft已将以下漏洞分配给严重等级】

  • CVE-2018-0758 - scripting Engine Memory Corruption Vulnerability

  • CVE-2018-0762 - scripting Engine Memory Corruption Vulnerability

  • CVE-2018-0767 - scripting Engine Information Disclosure Vulnerability

  • CVE-2018-0769 - scripting Engine Memory Corruption Vulnerability

  • CVE-2018-0770 - scripting Engine Memory Corruption Vulnerability

  • CVE-2018-0772 - scripting Engine Memory Corruption Vulnerability

  • CVE-2018-0773 - scripting Engine Memory Corruption Vulnerability

  • CVE-2018-0774 - scripting Engine Memory Corruption Vulnerability

  • CVE-2018-0775 - scripting Engine Memory Corruption Vulnerability

  • CVE-2018-0776 - scripting Engine Memory Corruption Vulnerability

  • CVE-2018-0777 - scripting Engine Memory Corruption Vulnerability

  • CVE-2018-0778 - scripting Engine Memory Corruption Vulnerability

  • CVE-2018-0780 - scripting Engine Information Disclosure Vulnerability

  • CVE-2018-0781 - scripting Engine Memory Corruption Vulnerability

  • CVE-2018-0797 - Microsoft Word Memory Corruption Vulnerability

  • CVE-2018-0800 - scripting Engine Information Disclosure Vulnerability


【Microsoft已将以下漏洞分配给高危等级】

  • CVE-2018-0741 - Microsoft Color Management Information Disclosure Vulnerability

  • CVE-2018-0743 - Windows Subsystem for Linux Elevation of Privilege Vulnerability

  • CVE-2018-0744 - Windows Elevation of Privilege Vulnerability

  • CVE-2018-0745 - Windows Information Disclosure Vulnerability

  • CVE-2018-0746 - Windows Information Disclosure Vulnerability

  • CVE-2018-0747 - Windows Information Disclosure Vulnerability

  • CVE-2018-0748 - Windows Elevation of Privilege Vulnerability

  • CVE-2018-0749 - SMB Server Elevation of Privilege Vulnerability

  • CVE-2018-0750 - Windows GDI Information Disclosure Vulnerability

  • CVE-2018-0751 - Windows Elevation of Privilege Vulnerability

  • CVE-2018-0752 - Windows Elevation of Privilege Vulnerability

  • CVE-2018-0753 - Windows IPSec Denial of Service Vulnerability

  • CVE-2018-0754 - ATMFD.dll Information Disclosure Vulnerability

  • CVE-2018-0764 - .NET and .NET Core Denial Of Service Vulnerability

  • CVE-2018-0766 - Microsoft Edge Information Disclosure Vulnerability

  • CVE-2018-0768 - scripting Engine Memory Corruption Vulnerability

  • CVE-2018-0784 - ASP.NET CoreElevation Of Privilege Vulnerability

  • CVE-2018-0786 - .NET Security Feature Bypass Vulnerability

  • CVE-2018-0788 - ATMFD.dll Information Disclosure Vulnerability

  • CVE-2018-0789 - Microsoft Office Spoofing Vulnerability

  • CVE-2018-0790 - Microsoft Office Information Disclosure Vulnerability

  • CVE-2018-0791 - Microsoft Outlook Remote Code Execution Vulnerability

  • CVE-2018-0792 - Microsoft Word Remote Code Execution

  • CVE-2018-0793 - Microsoft Outlook Remote Code Execution

  • CVE-2018-0794 - Microsoft Word Remote Code Execution

  • CVE-2018-0795 - Microsoft Office Remote Code Execution

  • CVE-2018-0796 - Microsoft Excel Remote Code Execution

  • CVE-2018-0798 - Microsoft Word Memory Corruption Vulnerability

  • CVE-2018-0799 - Microsoft Access Tampering Vulnerability

  • CVE-2018-0801 - Microsoft Office Remote Code Execution Vulnerability

  • CVE-2018-0802 - Microsoft Office Memory Corruption Vulnerability

  • CVE-2018-0803 - Microsoft Edge Elevation of Privilege Vulnerability

  • CVE-2018-0805 - Microsoft Word Remote Code Execution Vulnerability

  • CVE-2018-0806 - Microsoft Word Remote Code Execution Vulnerability

  • CVE-2018-0807 - Microsoft Word Remote Code Execution Vulnerability

  • CVE-2018-0812 - Microsoft Word Memory Corruption Vulnerability

  • CVE-2018-0818 - scripting Engine Security Feature Bypass

  • CVE-2018-0819 - Spoofing Vulnerability in Microsoft Office for MAC


【Microsoft已将以下漏洞分配给中危等级】

  • CVE-2018-0785 - ASP.NET Core Cross Site Request Forgery Vulnerability


【安全建议】

  1. 根据业务情况选择更新补丁

  2. 升级前，务必做好数据备份

信息来源http://blog.talosintelligence.com/2018/01/ms-tuesday.html
行业视角
研究机构
安全报告

法律声明 | 工作机会 | 联系我们

Copyright©2002-2017 Rights Reserved 中新网安 版权所有 皖ICP备05016981号-3