An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-1483.

The remote Windows host is missing security update 4530717.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when     Windows Hyper-V on a host server fails to properly     validate input from an authenticated user on a guest     operating system.  (CVE-2019-1471)

  - A remote code execution vulnerability exists when     Microsoft Windows OLE fails to properly validate user     input. An attacker could exploit the vulnerability to     execute malicious code.  (CVE-2019-1484)

  - A denial of service vulnerability exists in Remote     Desktop Protocol (RDP) when an attacker connects to the     target system using RDP and sends specially crafted     requests. An attacker who successfully exploited this     vulnerability could cause the RDP service on the target     system to stop responding.  (CVE-2019-1453)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1472, CVE-2019-1474)

  - An elevation of privilege vulnerability exists when the     Windows AppX Deployment Server improperly handles     junctions.  (CVE-2019-1483)

  - A remote code execution vulnerability exists when the     Windows font library improperly handles specially     crafted embedded fonts. An attacker who successfully     exploited this vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2019-1468)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-1465, CVE-2019-1466, CVE-2019-1467)

  - An information disclosure vulnerability exists when the     win32k component improperly provides kernel information.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1469)

  - An elevation of privilege vulnerability exists when     Windows AppX Deployment Service (AppXSVC) improperly     handles hard links. An attacker who successfully     exploited this vulnerability could run processes in an     elevated context. An attacker could then install     programs; view, change or delete data.  (CVE-2019-1476)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2019-1470)

  - A remote code execution vulnerability exists in the way     that the VBScript engine handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-1485)

  - A security feature bypass vulnerability exists when     Microsoft Defender improperly handles specific buffers.
    An attacker could exploit the vulnerability to trigger     warnings and false positives when no threat is present.
    (CVE-2019-1488)

The remote Windows host is missing security update 4530715.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when     Windows Hyper-V on a host server fails to properly     validate input from an authenticated user on a guest     operating system.  (CVE-2019-1471)

  - A remote code execution vulnerability exists when     Microsoft Windows OLE fails to properly validate user     input. An attacker could exploit the vulnerability to     execute malicious code.  (CVE-2019-1484)

  - A denial of service vulnerability exists in Remote     Desktop Protocol (RDP) when an attacker connects to the     target system using RDP and sends specially crafted     requests. An attacker who successfully exploited this     vulnerability could cause the RDP service on the target     system to stop responding.  (CVE-2019-1453)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1472, CVE-2019-1474)

  - An elevation of privilege vulnerability exists when the     Windows AppX Deployment Server improperly handles     junctions.  (CVE-2019-1483)

  - An information disclosure vulnerability exists when the     win32k component improperly provides kernel information.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1469)

  - A remote code execution vulnerability exists when the     Windows font library improperly handles specially     crafted embedded fonts. An attacker who successfully     exploited this vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2019-1468)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-1465, CVE-2019-1466, CVE-2019-1467)

  - An elevation of privilege vulnerability exists when the     Windows Printer Service improperly validates file paths     while loading printer drivers. An authenticated attacker     who successfully exploited this vulnerability could run     arbitrary code with elevated system privileges.
    (CVE-2019-1477)

  - An elevation of privilege vulnerability exists when     Windows AppX Deployment Service (AppXSVC) improperly     handles hard links. An attacker who successfully     exploited this vulnerability could run processes in an     elevated context. An attacker could then install     programs; view, change or delete data.  (CVE-2019-1476)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2019-1470)

  - A remote code execution vulnerability exists in the way     that the VBScript engine handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-1485)

  - A security feature bypass vulnerability exists when     Microsoft Defender improperly handles specific buffers.
    An attacker could exploit the vulnerability to trigger     warnings and false positives when no threat is present.
    (CVE-2019-1488)

The remote Windows host is missing security update 4530714.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when     Microsoft Windows OLE fails to properly validate user     input. An attacker could exploit the vulnerability to     execute malicious code.  (CVE-2019-1484)

  - A denial of service vulnerability exists in Remote     Desktop Protocol (RDP) when an attacker connects to the     target system using RDP and sends specially crafted     requests. An attacker who successfully exploited this     vulnerability could cause the RDP service on the target     system to stop responding.  (CVE-2019-1453)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1472, CVE-2019-1474)

  - An elevation of privilege vulnerability exists when the     Windows AppX Deployment Server improperly handles     junctions.  (CVE-2019-1483)

  - A remote code execution vulnerability exists when the     Windows font library improperly handles specially     crafted embedded fonts. An attacker who successfully     exploited this vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2019-1468)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-1465, CVE-2019-1466, CVE-2019-1467)

  - An information disclosure vulnerability exists when the     win32k component improperly provides kernel information.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1469)

  - An elevation of privilege vulnerability exists when     Windows AppX Deployment Service (AppXSVC) improperly     handles hard links. An attacker who successfully     exploited this vulnerability could run processes in an     elevated context. An attacker could then install     programs; view, change or delete data.  (CVE-2019-1476)

  - A remote code execution vulnerability exists in the way     that the VBScript engine handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-1485)

  - A security feature bypass vulnerability exists when     Microsoft Defender improperly handles specific buffers.
    An attacker could exploit the vulnerability to trigger     warnings and false positives when no threat is present.
    (CVE-2019-1488)

The remote Windows host is missing security update 4530689.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when     Microsoft Windows OLE fails to properly validate user     input. An attacker could exploit the vulnerability to     execute malicious code.  (CVE-2019-1484)

  - A denial of service vulnerability exists in Remote     Desktop Protocol (RDP) when an attacker connects to the     target system using RDP and sends specially crafted     requests. An attacker who successfully exploited this     vulnerability could cause the RDP service on the target     system to stop responding.  (CVE-2019-1453)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1472, CVE-2019-1474)

  - A remote code execution vulnerability exists when the     Windows font library improperly handles specially     crafted embedded fonts. An attacker who successfully     exploited this vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2019-1468)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-1465, CVE-2019-1466, CVE-2019-1467)

  - An information disclosure vulnerability exists when the     win32k component improperly provides kernel information.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1469)

  - An elevation of privilege vulnerability exists in     Windows when the Win32k component fails to properly     handle objects in memory. An attacker who successfully     exploited this vulnerability could run arbitrary code in     kernel mode. An attacker could then install programs;
    view, change, or delete data; or create new accounts     with full user rights.  (CVE-2019-1458)

  - An elevation of privilege vulnerability exists when     Windows AppX Deployment Service (AppXSVC) improperly     handles hard links. An attacker who successfully     exploited this vulnerability could run processes in an     elevated context. An attacker could then install     programs; view, change or delete data.  (CVE-2019-1476)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2019-1470)

  - A security feature bypass vulnerability exists when     Microsoft Defender improperly handles specific buffers.
    An attacker could exploit the vulnerability to trigger     warnings and false positives when no threat is present.
    (CVE-2019-1488)

  - A remote code execution vulnerability exists in the way     that the VBScript engine handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-1485)

The remote Windows host is missing security update 4530684.
It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability exists when     Windows Hyper-V on a host server fails to properly     validate input from an authenticated user on a guest     operating system.  (CVE-2019-1471)

  - A remote code execution vulnerability exists when     Microsoft Windows OLE fails to properly validate user     input. An attacker could exploit the vulnerability to     execute malicious code.  (CVE-2019-1484)

  - A denial of service vulnerability exists in Remote     Desktop Protocol (RDP) when an attacker connects to the     target system using RDP and sends specially crafted     requests. An attacker who successfully exploited this     vulnerability could cause the RDP service on the target     system to stop responding.  (CVE-2019-1453)

  - An information disclosure vulnerability exists when the     Windows kernel improperly handles objects in memory. An     attacker who successfully exploited this vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1472, CVE-2019-1474)

  - An elevation of privilege vulnerability exists when the     Windows AppX Deployment Server improperly handles     junctions.  (CVE-2019-1483)

  - A remote code execution vulnerability exists when the     Windows font library improperly handles specially     crafted embedded fonts. An attacker who successfully     exploited this vulnerability could take control of the     affected system. An attacker could then install     programs; view, change, or delete data; or create new     accounts with full user rights.  (CVE-2019-1468)

  - An information disclosure vulnerability exists when the     Windows GDI component improperly discloses the contents     of its memory. An attacker who successfully exploited     the vulnerability could obtain information to further     compromise the users system. There are multiple ways an     attacker could exploit the vulnerability, such as by     convincing a user to open a specially crafted document,     or by convincing a user to visit an untrusted webpage.
    The security update addresses the vulnerability by     correcting how the Windows GDI component handles objects     in memory. (CVE-2019-1465, CVE-2019-1466, CVE-2019-1467)

  - An information disclosure vulnerability exists when the     win32k component improperly provides kernel information.
    An attacker who successfully exploited the vulnerability     could obtain information to further compromise the users     system.  (CVE-2019-1469)

  - An elevation of privilege vulnerability exists when     Windows AppX Deployment Service (AppXSVC) improperly     handles hard links. An attacker who successfully     exploited this vulnerability could run processes in an     elevated context. An attacker could then install     programs; view, change or delete data.  (CVE-2019-1476)

  - An information disclosure vulnerability exists when     Windows Hyper-V on a host operating system fails to     properly validate input from an authenticated user on a     guest operating system.  (CVE-2019-1470)

  - A remote code execution vulnerability exists in the way     that the VBScript engine handles objects in memory. The     vulnerability could corrupt memory in such a way that an     attacker could execute arbitrary code in the context of     the current user. An attacker who successfully exploited     the vulnerability could gain the same user rights as the     current user.  (CVE-2019-1485)

  - A security feature bypass vulnerability exists when     Microsoft Defender improperly handles specific buffers.
    An attacker could exploit the vulnerability to trigger     warnings and false positives when no threat is present.
    (CVE-2019-1488)

ID	Name	Product	Family	Severity
131933	KB4530717: Windows 10 Version 1803 December 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high
131932	KB4530715: Windows 10 Version 1809 and Windows Server 2019 December 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high
131931	KB4530714: Windows 10 Version 1709 December 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high
131927	KB4530689: Windows 10 Version 1607 and Windows Server 2016 December 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high
131926	KB4530684: Windows 10 Version 1903 and Windows 10 Version 1909 December 2019 Security Update	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2019-1476

high

Tenable Plugins

high

high

high

high

high