Netanel Ben-Simon

**Name of the Vulnerable Software and Affected Versions** Microsoft Excel (affected versions not specified) **Description** The issue is related to an information disclosure vulnerability in Microsoft Excel. It is associated with a buffer overflow in memory, which can allow an attacker to gain unauthorized access to protected information. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) **Description** The issue is related to incorrect code generation management in Microsoft Office, which can be exploited by attackers to execute arbitrary code using a specially crafted file. This allows remote attackers to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Office (affected versions not specified) **Description** The issue is related to an information disclosure vulnerability in Microsoft Office. It is caused by a lack of protection for sensitive data. Exploitation of this issue may allow an attacker to disclose protected information and affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows 10 versions 1607 through 1909 Windows 8.1 version 6.3 **Description** The issue is related to errors in handling objects in memory within the Win32k component of the Windows operating system. This can be exploited by an attacker to elevate their privileges using a specially crafted application. The vulnerability allows attackers to affect the system, potentially leading to an elevation of privileges. **Recommendations** For Windows 10 versions 1607 through 1909, update to a version that includes the fix for this issue. For Windows 8.1 version 6.3, consider applying security patches or updates that address this specific problem as a temporary workaround, until a more permanent solution is available. As a general mitigation measure, restrict access to sensitive system components and ensure that all applications are run with the least privileges necessary to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Windows 10 x64 1909 (OS Build 18363.719) Windows 10 version 10.0.18362.719 (WinBuild.160101.0800) **Description** The issue is related to errors in processing objects in memory in the Win32k component of the Windows operating system. This can allow an attacker to elevate their privileges. An elevation-of-privilege vulnerability exists, allowing attackers to affect the system. **Recommendations** For Windows 10 x64 1909 (OS Build 18363.719), update to a version that includes the fix for this issue. For Windows 10 version 10.0.18362.719 (WinBuild.160101.0800), update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Win32k component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Windows versions prior to 10.0.18363 **Description** An elevation of privilege issue exists due to the Windows kernel-mode driver's failure to properly handle objects in memory. This allows an attacker to potentially elevate their privileges. The issue is related to errors in processing objects in memory. **Recommendations** For Windows versions prior to 10.0.18363, update to a version that includes the necessary security patches to resolve the issue. As a temporary workaround, consider restricting access to sensitive system resources to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in the Windows kernel-mode driver, which fails to properly handle objects in memory. This vulnerability can be exploited to allow an attacker to elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Information Services (affected versions not specified) **Description** The issue is related to errors in handling objects in memory, which can be exploited by a remote attacker to elevate privileges. This allows an unprivileged function, run by a user, to execute code in the context of NT AUTHORITYsystem, thus escaping the sandbox. The vulnerability exists due to the failure to check the length of a buffer before copying memory to it. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to an elevation of privilege vulnerability in the Win32k component of Windows, which fails to properly handle objects in memory. This can allow an attacker to execute arbitrary code in kernel mode using a specially crafted application. The vulnerability enables attackers to affect the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to errors in handling objects in memory by the Windows kernel. This can be exploited by an attacker to elevate their privileges and run arbitrary code in kernel mode using a specially crafted application. To exploit this, an attacker must first log on to the system. Successful exploitation could allow an attacker to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Windows (affected versions not specified) **Description** The issue is related to an information disclosure problem in the win32k component, which fails to properly protect sensitive data. This could allow an attacker to disclose protected information. There is no information available about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat and Reader versions 2018.011.20063 and earlier Adobe Acrobat and Reader versions 2017.011.30102 and earlier Adobe Acrobat and Reader versions 2015.006.30452 and earlier **Description** The issue is related to an untrusted pointer dereference, which could allow for arbitrary code execution if successfully exploited. This can be achieved through a specially crafted GIF file, potentially enabling a remote attacker to execute code. The vulnerability affects Adobe Acrobat, Adobe Reader, Adobe Acrobat Document Cloud, and Adobe Reader Document Cloud. **Recommendations** For Adobe Acrobat and Reader versions 2018.011.20063 and earlier, update to a version later than 2018.011.20063 to resolve the issue. For Adobe Acrobat and Reader versions 2017.011.30102 and earlier, update to a version later than 2017.011.30102 to resolve the issue. For Adobe Acrobat and Reader versions 2015.006.30452 and earlier, update to a version later than 2015.006.30452 to resolve the issue. As a temporary workaround, consider avoiding the use of specially crafted GIF files until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat versions prior to 2018.011.20063 Adobe Acrobat versions prior to 2017.011.30102 Adobe Acrobat versions prior to 2015.006.30452 Adobe Acrobat Reader versions prior to 2018.011.20063 Adobe Acrobat Reader versions prior to 2017.011.30102 Adobe Acrobat Reader versions prior to 2015.006.30452 **Description** The issue is related to an out-of-bounds read in memory, which could allow an attacker to disclose protected information. Successful exploitation of this issue may lead to information disclosure. **Recommendations** For Adobe Acrobat versions prior to 2018.011.20063, update to version 2018.011.20063 or later. For Adobe Acrobat versions prior to 2017.011.30102, update to version 2017.011.30102 or later. For Adobe Acrobat versions prior to 2015.006.30452, update to version 2015.006.30452 or later. For Adobe Acrobat Reader versions prior to 2018.011.20063, update to version 2018.011.20063 or later. For Adobe Acrobat Reader versions prior to 2017.011.30102, update to version 2017.011.30102 or later. For Adobe Acrobat Reader versions prior to 2015.006.30452, update to version 2015.006.30452 or later.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat and Reader versions 2015.006.30452 and earlier Adobe Acrobat and Reader versions 2017.011.30102 and earlier Adobe Acrobat and Reader versions 2018.011.20063 and earlier **Description** The issue is related to an out-of-bounds read in memory, which could allow a remote attacker to gain unauthorized access to protected information. This could lead to information disclosure. **Recommendations** For Adobe Acrobat and Reader versions 2015.006.30452 and earlier, update to a version later than 2015.006.30452. For Adobe Acrobat and Reader versions 2017.011.30102 and earlier, update to a version later than 2017.011.30102. For Adobe Acrobat and Reader versions 2018.011.20063 and earlier, update to a version later than 2018.011.20063.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat versions 2018.011.20063 and earlier Adobe Acrobat versions 2017.011.30102 and earlier Adobe Acrobat versions 2015.006.30452 and earlier Adobe Reader versions 2018.011.20063 and earlier Adobe Reader versions 2017.011.30102 and earlier Adobe Reader versions 2015.006.30452 and earlier **Description** The issue is related to an untrusted pointer dereference vulnerability. This vulnerability can be exploited by a remote attacker using a specially crafted GIF file, potentially allowing them to execute arbitrary code. **Recommendations** For Adobe Acrobat and Reader versions 2018.011.20063 and earlier, update to a version later than 2018.011.20063 to resolve the issue. For Adobe Acrobat and Reader versions 2017.011.30102 and earlier, update to a version later than 2017.011.30102 to resolve the issue. For Adobe Acrobat and Reader versions 2015.006.30452 and earlier, update to a version later than 2015.006.30452 to resolve the issue. As a temporary workaround, consider avoiding the use of specially crafted GIF files until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat and Reader versions 2018.011.20063 and earlier Adobe Acrobat and Reader versions 2017.011.30102 and earlier Adobe Acrobat and Reader versions 2015.006.30452 and earlier **Description** The issue is related to an out-of-bounds write vulnerability in Adobe Acrobat and Reader. This vulnerability can be exploited by an attacker using a specially crafted PDF file, potentially leading to arbitrary code execution. The vulnerability allows a remote attacker to execute arbitrary code. **Recommendations** For Adobe Acrobat and Reader versions 2018.011.20063 and earlier, update to a version later than 2018.011.20063 to resolve the issue. For Adobe Acrobat and Reader versions 2017.011.30102 and earlier, update to a version later than 2017.011.30102 to resolve the issue. For Adobe Acrobat and Reader versions 2015.006.30452 and earlier, update to a version later than 2015.006.30452 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat and Reader versions 2018.011.20063 and earlier Adobe Acrobat and Reader versions 2017.011.30102 and earlier Adobe Acrobat and Reader versions 2015.006.30452 and earlier **Description** The issue is related to an out-of-bounds read operation in memory, which could allow an attacker to gain unauthorized access to protected information. Successful exploitation of this issue may lead to information disclosure, potentially allowing attackers to obtain sensitive information. **Recommendations** For versions 2018.011.20063 and earlier, update to a version later than 2018.011.20063 to resolve the issue. For versions 2017.011.30102 and earlier, update to a version later than 2017.011.30102 to resolve the issue. For versions 2015.006.30452 and earlier, update to a version later than 2015.006.30452 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat versions 2018.011.20063 and earlier Adobe Acrobat versions 2017.011.30102 and earlier Adobe Acrobat versions 2015.006.30452 and earlier Adobe Acrobat Reader versions 2018.011.20063 and earlier Adobe Acrobat Reader versions 2017.011.30102 and earlier Adobe Acrobat Reader versions 2015.006.30452 and earlier **Description** The issue is related to an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure, allowing attackers to obtain sensitive information. **Recommendations** For Adobe Acrobat and Reader versions 2018.011.20063 and earlier, update to a version later than 2018.011.20063. For Adobe Acrobat and Reader versions 2017.011.30102 and earlier, update to a version later than 2017.011.30102. For Adobe Acrobat and Reader versions 2015.006.30452 and earlier, update to a version later than 2015.006.30452. As a temporary workaround, consider restricting access to sensitive information until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat and Reader versions 2015.006.30452 and earlier Adobe Acrobat and Reader versions 2017.011.30102 and earlier Adobe Acrobat and Reader versions 2018.011.20063 and earlier **Description** The issue is related to an out-of-bounds write vulnerability in memory. This can be exploited by a remote attacker using a specially crafted PDF file, potentially allowing them to execute arbitrary code. **Recommendations** For versions 2015.006.30452 and earlier, update to a version later than 2015.006.30452 to resolve the issue. For versions 2017.011.30102 and earlier, update to a version later than 2017.011.30102 to resolve the issue. For versions 2018.011.20063 and earlier, update to a version later than 2018.011.20063 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Adobe Acrobat and Reader versions 2018.011.20063 and earlier Adobe Acrobat and Reader versions 2017.011.30102 and earlier Adobe Acrobat and Reader versions 2015.006.30452 and earlier **Description** The issue is related to an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution. This can be achieved by using a specially crafted U3D file, allowing a remote attacker to execute arbitrary code. **Recommendations** For Adobe Acrobat and Reader versions 2018.011.20063 and earlier, update to a version later than 2018.011.20063 to resolve the issue. For Adobe Acrobat and Reader versions 2017.011.30102 and earlier, update to a version later than 2017.011.30102 to resolve the issue. For Adobe Acrobat and Reader versions 2015.006.30452 and earlier, update to a version later than 2015.006.30452 to resolve the issue. As a temporary workaround, consider avoiding the use of U3D files in Adobe Acrobat and Reader until a patch is available.