February, 2018: Patch Tuesday: Adobe Flash Active Attacks

Welcome to this February Patch Tuesday Bulletin. This month we have 56 unique CVE’s listed, one advisory for Adobe Flash, and 6 technologies with critical updates. The good news is that none of the CVE’s associated with MS technology have been reported to be exploited in the wild. The bad news is that CVE-2018-4878, affecting Adobe Flash, is being exploited in targeted attacks. Attacks are being carried out with Office documents that have embedded flash sent through email. Although not a Microsoft product, it would be wise to patch Adobe Flash as soon as possible. The MS products this month are almost exactly the same as last month so, if possible, start collecting a baseline information for how long it takes to test and deploy updates.

Over the years we've had millions of visitors to UltimateWindowsSecurity.com. Every month we have thousands and thousands of visitors to our Security Log Encyclopedia which documents all of the Security Log event ID’s for Windows Server OS’s. Back in 2007 when SharePoint added auditing capability, I realized that my audience not only needed the event information from SharePoint but I also found a similar need in SQL Server and Exchange. So not only did I document the data but I also started to develop the means to extract that event data from these applications so that it’s accessible and useable to the end user. Some 8 years later and LOGbinder is continuing to grow as companies realize LOGbinder bridges the gap between these applications and their infosec team. Visit LOGbinder.com to download a free 30-day fully functional trial and see the security event data that you have literally been missing.

So, without further ado, here’s the chart of MS patches this month.

Patch data provided by:

Technology

Products Affected

Severity

Reference

Workaround/ Exploited

Vulnerability Info

IE

IE 9,10,11

Critical

CVE-2018-0840

CVE-2018-0866

*Workaround: No

**Exploited: No

Remote Code Execution

Edge

Microsoft Edge

Critical

CVE-2018-0763

CVE-2018-0771

CVE-2018-0834

CVE-2018-0835

CVE-2018-0836

CVE-2018-0837

CVE-2018-0838

CVE-2018-0839

CVE-2018-0840

CVE-2018-0856

CVE-2018-0857

CVE-2018-0859

CVE-2018-0860

CVE-2018-0861

*Workaround: No

**Exploited: No

Information Disclosure

Security Feature Bypass

Remote Code Execution

Windows

Windows 7, 8.1, RT 8.1, 10

Server 2008, 2008 R2, 2012, 2012 R2, 2016

Critical

CVE-2018-0832

CVE-2018-0833

CVE-2018-0842

CVE-2018-0843

CVE-2018-0844

CVE-2018-0846

CVE-2018-0742

CVE-2018-0755

CVE-2018-0756

CVE-2018-0757

CVE-2018-0760

CVE-2018-0761

CVE-2018-0809

CVE-2018-0810

CVE-2018-0820

CVE-2018-0821

CVE-2018-0822

CVE-2018-0823

CVE-2018-0825

CVE-2018-0826

CVE-2018-0827

CVE-2018-0828

CVE-2018-0829

CVE-2018-0830

CVE-2018-0831

CVE-2018-0847

CVE-2018-0855

*Workaround: No

**Exploited: No

Information Disclosure

Denial of Service

Remote Code Execution

Elevation of Privilege

Security Feature Bypass

Office, Office Services, and Web Apps

Office 2007, 2010, 2013, 2016

Word 2007, 2010, 2013, 2016

Outlook 2007, 2010, 2013, 2016

SharePoint Server 2016

Project Server 2013

Critical

CVE-2018-0845

CVE-2018-0848

CVE-2018-0849

CVE-2018-0862

CVE-2018-0841

CVE-2018-0850

CVE-2018-0851

CVE-2018-0852

CVE-2018-0853

CVE-2018-0864

CVE-2018-0869

*Workaround: No

**Exploited: No

Remote Code Execution

Elevation of Privilege

Information Disclosure

ChakraCore

ChakraCore

Critical

CVE-2018-0834

CVE-2018-0835

CVE-2018-0836

CVE-2018-0837

CVE-2018-0838

CVE-2018-0840

CVE-2018-0856

CVE-2018-0857

CVE-2018-0858

CVE-2018-0859

CVE-2018-0860

*Workaround: No

**Exploited: No

Remote Code Execution

Adobe Flash

28.0.0.137 and earlier versions

Critical

CVE-2018-4877

CVE-2018-4878**

ADV180004

*Workaround: No

**Exploited: Yes

Remote Code Execution


Send me this chart next Patch Tuesday.
Email:
We will not share your address. Unsubscribe anytime.