SB2019061117 - Information disclosure in Windows GDI
Published: June 11, 2019 Updated: September 10, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 7 secuirty vulnerabilities.
1) Out-of-bounds read (CVE-ID: CVE-2019-1015)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when processing untrusted data within Windows GDI component. A local user can run a specially crafted application, trigger out-of-bounds read error and read contents of memory on the system.
2) Out-of-bounds read (CVE-ID: CVE-2019-1050)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when processing untrusted data within Windows GDI component. A local user can run a specially crafted application, trigger out-of-bounds read error and read contents of memory on the system.
3) Out-of-bounds read (CVE-ID: CVE-2019-1049)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when processing untrusted data within Windows GDI component. A local user can run a specially crafted application, trigger out-of-bounds read error and read contents of memory on the system.
4) Out-of-bounds read (CVE-ID: CVE-2019-1048)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when processing untrusted data within Windows GDI component. A local user can run a specially crafted application, trigger out-of-bounds read error and read contents of memory on the system.
5) Out-of-bounds read (CVE-ID: CVE-2019-1047)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when processing untrusted data within Windows GDI component. A local user can run a specially crafted application, trigger out-of-bounds read error and read contents of memory on the system.
6) Out-of-bounds read (CVE-ID: CVE-2019-1046)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when processing untrusted data within Windows GDI component. A local user can run a specially crafted application, trigger out-of-bounds read error and read contents of memory on the system.
7) Out-of-bounds read (CVE-ID: CVE-2019-1016)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when processing untrusted data within Windows GDI component. A local user can run a specially crafted application, trigger out-of-bounds read error and read contents of memory on the system.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1015
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1050
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1049
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1048
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1047
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1046
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1016