AG公司云
微软宣布4月清静补丁 修复113个清静问题
2020-04-15
微软于周二宣布了4月清静更新补丁，修复了113个从简朴的诱骗攻击到远程执行代码的清静问题。产品涉及Android App、Apps、Microsoft Dynamics、Microsoft Graphics Component、Microsoft JET Database Engine、Microsoft Office、Microsoft Office SharePoint、Microsoft Scripting Engine、Microsoft Windows、Microsoft Windows DNS、Open Source Software、Remote Desktop Client、Visual Studio、Windows Defender、Windows Hyper-V、Windows Kernel、Windows Media以及Windows Update Stack。
https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/2020-Apr
要害误差概述
本次更新微软共修复17个Critical级别误差，部分概述如下。
- CVE-2020-0687
Microsoft Graphics 远程代码执行误差
误差由Windows字体库对特制嵌入式字体处置惩罚不当造成，攻击者可能以多种方法使用此误差。
一种是在基于 web 的场景中，通过诱导用户会见特制的网站来使用误差。另一种是在文件共享场景下，会诱导用户翻开特制文档。
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0687
- CVE-2020-0907
Microsoft 图形组件远程代码执行误差
在 Microsoft 图形组件处置惩罚内存中工具的历程中保存一个远程代码执行误差。仅当用户翻开特制文件时，才会触发此误差，乐成使用误差的攻击者可以在目的系统上执行恣意代码。
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0907
- CVE-2020-0929，CVE-2020-0931，CVE-2020-0932
Microsoft SharePoint远程执行代码误差
若要使用这些误差，攻击者需要将特制的SharePoint程序包上传至受影响版本的SharePoint，以允许他们在SharePoint应用程序池和SharePoint服务器中执行恣意代码。
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0929
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0931
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0932
- CVE-2020-0938和CVE-2020-1020
Windows Adobe Font Manager库远程执行代码误差
当Windows Adob??e Type Manager库对multi-master字体（Adobe Type 1 PostScript名堂）处置惩罚不当时泛起的远程执行代码误差。
若是攻击者在Windows 10以外的任何操作系统上使用此bug，可实现远程执行恣意代码。在Windows 10上，它们将仅限于以有限的特权在AppContainer沙箱中执行代码。
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0938
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1020
- CVE-2020-0968
Internet Explorer 中，剧本引擎在处置惩罚内存中工具的历程中保存一个远程代码执行误差。
该误差可破损内存，使攻击者在目今用户的上下文中执行恣意代码。乐成使用此误差的攻击者可获得与目今用户相同的权限。
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0968
- CVE-2020-0970、CVE-2020-0969
划分是ChakraCore剧本引擎和Chakra剧本引擎处置惩罚内存中工具时保存的远程代码执行误差。影响Microsoft Edge (EdgeHTML-based)，该误差可破损内存，使攻击者在目今用户的上下文中执行恣意代码。乐成使用此误差的攻击者可获得与目今用户相同的权限。
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0970
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0969
相关信息如下：
| 产品 | CVE 编号 | CVE 问题 | 严重水平 |
| Microsoft Dynamics | CVE-2020-1022 | Dynamics Business Central 远程代码执行误差 | Critical |
| Microsoft Graphics Component | CVE-2020-0907 | Microsoft Graphics Components 远程代码执行误差 | Critical |
| Microsoft Graphics Component | CVE-2020-0687 | Microsoft Graphics 远程代码执行误差 | Critical |
| Microsoft Graphics Component | CVE-2020-0938 | Adobe Font Manager Library 远程代码执行误差 | Critical |
| Microsoft Graphics Component | CVE-2020-1020 | Adobe Font Manager Library 远程代码执行误差 | Critical |
| Microsoft Office | CVE-2020-0931 | Microsoft SharePoint 远程代码执行误差 | Critical |
| Microsoft Office SharePoint | CVE-2020-0929 | Microsoft SharePoint 远程代码执行误差 | Critical |
| Microsoft Office SharePoint | CVE-2020-0932 | Microsoft SharePoint 远程代码执行误差 | Critical |
| Microsoft Office SharePoint | CVE-2020-0974 | Microsoft SharePoint 远程代码执行误差 | Critical |
| Microsoft Scripting Engine | CVE-2020-0968 | Scripting Engine 内存破损误差 | Critical |
| Microsoft Scripting Engine | CVE-2020-0969 | Chakra Scripting Engine 内存破损误差 | Critical |
| Microsoft Scripting Engine | CVE-2020-0970 | Scripting Engine 内存破损误差 | Critical |
| Microsoft Windows | CVE-2020-0965 | Microsoft Windows Codecs Library 远程代码执行误差 | Critical |
| Windows Hyper-V | CVE-2020-0910 | Windows Hyper-V 远程代码执行误差 | Critical |
| Windows Media | CVE-2020-0948 | Media Foundation 内存破损误差 | Critical |
| Windows Media | CVE-2020-0949 | Media Foundation 内存破损误差 | Critical |
| Windows Media | CVE-2020-0950 | Media Foundation 内存破损误差 | Critical |
| Android App | CVE-2020-0943 | Microsoft YourPhone Application for Android Authentication Bypass Vulnerability | Important |
| Apps | CVE-2020-1019 | Microsoft RMS Sharing App for Mac 特权提升误差 | Important |
| Microsoft Dynamics | CVE-2020-1018 | Microsoft Dynamics Business Central/NAV Information Disclosure | Important |
| Microsoft Dynamics | CVE-2020-1049 | Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability | Important |
| Microsoft Dynamics | CVE-2020-1050 | Microsoft Dynamics 365 (On-Premise) Cross Site Scripting Vulnerability | Important |
| Microsoft Graphics Component | CVE-2020-0784 | DirectX 特权提升误差 | Important |
| Microsoft Graphics Component | CVE-2020-0987 | Microsoft Graphics Component 信息泄露误差 | Important |
| Microsoft Graphics Component | CVE-2020-1004 | Windows Graphics Component 特权提升误差 | Important |
| Microsoft Graphics Component | CVE-2020-1005 | Microsoft Graphics Component 信息泄露误差 | Important |
| Microsoft Graphics Component | CVE-2020-0952 | Windows GDI 信息泄露误差 | Important |
| Microsoft Graphics Component | CVE-2020-0958 | Win32k 特权提升误差 | Important |
| Microsoft Graphics Component | CVE-2020-0964 | GDI+ 远程代码执行误差 | Important |
| Microsoft Graphics Component | CVE-2020-0982 | Microsoft Graphics Component 信息泄露误差 | Important |
| Microsoft JET Database Engine | CVE-2020-0988 | Jet Database Engine 远程代码执行误差 | Important |
| Microsoft JET Database Engine | CVE-2020-0992 | Jet Database Engine 远程代码执行误差 | Important |
| Microsoft JET Database Engine | CVE-2020-0994 | Jet Database Engine 远程代码执行误差 | Important |
| Microsoft JET Database Engine | CVE-2020-0995 | Jet Database Engi
?
您的联系方法
购置热线
提交项目需求接待加入AG公司科技，成为我们的相助同伴！
? 2025 NSFOCUS AG公司科技 www.nsfocus.com All Rights Reserved . 京公网安备 11010802021605号 京ICP备14004349号 京ICP证110355号 |
