CVE-2018-1004

EUVD-2018-11666
A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Internet Explorer 9, Windows RT 8.1, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 96%
Affected Products (NVD)
VendorProductVersion
microsoftwindows_10
-
microsoftwindows_7
-
microsoftwindows_8.1
-
microsoftwindows_rt_8.1
-
microsoftwindows_server_2012
-
microsoftwindows_server_2016
-
𝑥
= Vulnerable software versions
Windows Releases
Platform
Version
Windows 10
(x64, x86)
KB4093111
1511 (x64, x86)
KB4093109
1607 (x64, x86)
KB4093119
1703 (x64, x86)
KB4093107
1709 (x64, x86)
KB4093112
Windows 7
Service Pack 1 (x64, x86)
KB4093118
Windows 8.1
(x64, x86)
KB4093114
(x64, x86)
KB4093115
Windows RT 8.1
All
KB4093114
Windows Server 2008
Service Pack 2 (x64, x86)
KB4092946
Windows Server 2008 R2
Service Pack 1 (x64)
KB4093118
Service Pack 1 Server Core (x64)
KB4093118
Windows Server 2012
Server Core
KB4093123
Standard
KB4093123
Windows Server 2012 R2
Server Core
KB4093114
Server Core
KB4093115
Standard
KB4093114
Standard
KB4093115
Windows Server 2016
Server Core
KB4093119
Standard
KB4093119
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/103657
http://www.securitytracker.com/id/1040655
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1004
http://www.securityfocus.com/bid/103657
http://www.securitytracker.com/id/1040655
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1004