91百色国产视频|亚洲欧美伦理中文字幕在线|亚洲中文乱码在线|天堂影音av在线|国产激情人妻熟女|AV无码高清在线|超碰在线免费观看操|亚洲va中文字幕|欧美极品性爱四区|国产精品二区在线观看

2020年5月13日，微軟發(fā)布5月軟件安全更新。修復(fù)了111個(gè)安全問(wèn)題，涉及Microsoft Windows、Internet Explorer、Microsoft Edge、.NET Framework、Microsoft Office、Visual Studio等廣泛使用的產(chǎn)品，其中包括特權(quán)提升和遠(yuǎn)程代碼執(zhí)行等高危漏洞類型。本月微軟月度更新修復(fù)的漏洞中，嚴(yán)重程度為關(guān)鍵（Critical）的漏洞共有16個(gè)，重要（Important）漏洞有95個(gè)。其中Win32k 特權(quán)提升（CVE-2020-1054）漏洞的PoC已公開(kāi)，請(qǐng)相關(guān)用戶及時(shí)更新補(bǔ)丁進(jìn)行防護(hù)。

漏洞描述

1.       CVE-2020-1153：Microsoft圖形組件遠(yuǎn)程代碼執(zhí)行漏洞

Graphics Components是Microsoft Windows操作系統(tǒng)和Microsoft Windows Server操作系統(tǒng)的一個(gè)圖形組件。Microsoft Graphics Components在處理內(nèi)存對(duì)象的過(guò)程中存在遠(yuǎn)程代碼執(zhí)行漏洞。攻擊者可通過(guò)誘導(dǎo)用戶打開(kāi)特制文件來(lái)利用此漏洞，成功利用此漏洞的攻擊者可在目標(biāo)系統(tǒng)上執(zhí)行任意代碼。

危害等級(jí)：嚴(yán)重

官方通告：

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1153

2.       CVE-2020-1062：Internet Explorer 內(nèi)存損壞漏洞

當(dāng) Internet Explorer 不正確地訪問(wèn)內(nèi)存中的對(duì)象時(shí)，存在遠(yuǎn)程執(zhí)行代碼漏洞。該漏洞可能以一種攻擊者可以在當(dāng)前用戶的上下文中執(zhí)行任意代碼的方式損壞內(nèi)存。成功利用該漏洞的攻擊者可以獲得與當(dāng)前用戶相同的用戶權(quán)限。當(dāng)用戶訪問(wèn)一個(gè)特別設(shè)計(jì)的、由攻擊者控制的web頁(yè)面時(shí)，可能會(huì)觸發(fā)此漏洞。

危害等級(jí)：嚴(yán)重

官方通告：

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1062

3.       CVE-2020-1023、CVE-2020-1024、CVE-2020–1102和CVE-2020-1069：Microsoft SharePoint 遠(yuǎn)程執(zhí)行代碼漏洞

以上4個(gè)為微軟SharePoint中的遠(yuǎn)程代碼執(zhí)行漏洞。攻擊者可以利用此類漏洞獲得在受影響終端或服務(wù)器上執(zhí)行任意代碼的能力。由于SharePoint無(wú)法檢查應(yīng)用程序包的源標(biāo)記，前3個(gè)漏洞可以誘導(dǎo)用戶打開(kāi)一個(gè)特別制作的SharePoint應(yīng)用程序文件從而進(jìn)行利用。由于SharePoint Server無(wú)法正確識(shí)別和篩選不安全的 ASP.NET Web 控件，經(jīng)過(guò)身份驗(yàn)證的攻擊者通過(guò)上傳一個(gè)特別制作的頁(yè)面到SharePoint服務(wù)器，可成功利用CVE-2020-1069漏洞。

危害等級(jí)：嚴(yán)重

官方通告：

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1023

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1024

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1102

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1069

4.       CVE-2020-1054（PoC已公開(kāi)）/CVE-2020-1143：Win32k特權(quán)提升漏洞

由于Windows kernel-mode driver未能正確處理內(nèi)存中的對(duì)象，導(dǎo)致存在兩個(gè)特權(quán)提升漏洞。攻擊者可通過(guò)登錄目標(biāo)系統(tǒng)并運(yùn)行特制的應(yīng)用程序來(lái)進(jìn)行利用，成功利用此漏洞的攻擊者可以在系統(tǒng)內(nèi)核模式中執(zhí)行任意代碼。

危害等級(jí)：高危

官方通告：

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-1054

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-1143

5.       CVE-2020-1067：Windows 遠(yuǎn)程執(zhí)行代碼漏洞

Windows 在處理內(nèi)存對(duì)象的過(guò)程中存在遠(yuǎn)程執(zhí)行代碼漏洞。具有域用戶帳戶的攻擊者通過(guò)發(fā)送特殊的請(qǐng)求，從而使 Windows執(zhí)行提升權(quán)限的任意代碼。成功利用此漏洞可以在受影響的Windows上以更高的權(quán)限執(zhí)行任意代碼。

危害等級(jí)：高危

官方通告：

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1067

6.       CVE-2020-0901：Microsoft Excel遠(yuǎn)程執(zhí)行代碼漏洞

由于Microsoft Excel無(wú)法正確處理內(nèi)存中的對(duì)象，導(dǎo)致存在遠(yuǎn)程執(zhí)行代碼漏洞。攻擊者通過(guò)誘使用戶使用受影響版本的Microsoft Excel打開(kāi)經(jīng)過(guò)特殊設(shè)計(jì)的文件進(jìn)行利用。成功利用此漏洞的攻擊者可以獲得與當(dāng)前用戶相同的系統(tǒng)控制權(quán)限。

危害等級(jí)：高危

官方通告：

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0901

影響版本

重點(diǎn)關(guān)注以下漏洞，更多請(qǐng)查閱官方通告鏈接：

https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/2020-May

1.       CVE-2020-1054、CVE-2020-1143、CVE-2020-1067、CVE-2020-1153

Windows 10 for 32-bit Systems

Windows 10 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1709 for 32-bit Systems

Windows 10 Version 1709 for ARM64-based Systems

Windows 10 Version 1709 for x64-based Systems

Windows 10 Version 1803 for 32-bit Systems

Windows 10 Version 1803 for ARM64-based Systems

Windows 10 Version 1803 for x64-based Systems

Windows 10 Version 1809 for 32-bit Systems

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1903 for 32-bit Systems

Windows 10 Version 1903 for ARM64-based Systems

Windows 10 Version 1903 for x64-based Systems

Windows 10 Version 1909 for 32-bit Systems

Windows 10 Version 1909 for ARM64-based Systems

Windows 10 Version 1909 for x64-based Systems

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems Service Pack 1

Windows 8.1 for 32-bit systems

Windows 8.1 for x64-based systems

Windows RT 8.1

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)

Windows Server 2008 for Itanium-Based Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)

Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)

Windows Server 2012

Windows Server 2012 (Server Core installation)

Windows Server 2012 R2

Windows Server 2012 R2 (Server Core installation)

Windows Server 2016

Windows Server 2016 (Server Core installation)

Windows Server 2019

Windows Server 2019 (Server Core installation)

Windows Server, version 1803 (Server Core Installation)

Windows Server, version 1903 (Server Core installation)

Windows Server, version 1909 (Server Core installation)

2.       CVE-2020-1062

Internet Explorer 11：

Windows 10 Version 1803 for 32-bit Systems

Windows 10 Version 1803 for x64-based Systems

Windows 10 Version 1803 for ARM64-based Systems

Windows 10 Version 1809 for 32-bit Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1809 for ARM64-based Systems

Windows Server 2019

Windows 10 Version 1909 for 32-bit Systems

Windows 10 Version 1909 for x64-based Systems

Windows 10 Version 1909 for ARM64-based Systems

Windows 10 Version 1709 for 32-bit Systems

Windows 10 Version 1709 for x64-based Systems

Windows 10 Version 1709 for ARM64-based Systems

Windows 10 Version 1903 for 32-bit Systems

Windows 10 Version 1903 for x64-based Systems

Windows 10 Version 1903 for ARM64-based Systems

Windows 10 for 32-bit Systems

Windows 10 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 Version 1607 for x64-based Systems

Windows Server 2016

Windows 7 for 32-bit Systems Service Pack 1

Windows 7 for x64-based Systems Service Pack 1

Windows 8.1 for 32-bit systems

Windows 8.1 for x64-based systems

Windows RT 8.1

Windows Server 2008 R2 for x64-based Systems Service Pack 1

Windows Server 2012

Windows Server 2012 R2

Internet Explorer 9：

Windows Server 2008 for 32-bit Systems Service Pack 2

Windows Server 2008 for x64-based Systems Service Pack 2

3.       CVE-2020-1023、CVE-2020-1024、CVE-2020-1069

Microsoft SharePoint Enterprise Server 2016

Microsoft SharePoint Foundation 2013 Service Pack 1

Microsoft SharePoint Server 2019

4.       CVE-2020-1102

Microsoft SharePoint Enterprise Server 2016

Microsoft SharePoint Server 2019

5.       CVE-2020-0901

Microsoft 365 Apps for Enterprise for 32-bit Systems

Microsoft 365 Apps for Enterprise for 64-bit Systems

Microsoft Excel 2010 Service Pack 2 (32-bit editions)

Microsoft Excel 2010 Service Pack 2 (64-bit editions)

Microsoft Excel 2013 RT Service Pack 1

Microsoft Excel 2013 Service Pack 1 (32-bit editions)

Microsoft Excel 2013 Service Pack 1 (64-bit editions)

Microsoft Excel 2016 (32-bit edition)

Microsoft Excel 2016 (64-bit edition)

Microsoft Office 2016 for Mac

Microsoft Office 2019 for 32-bit editions

Microsoft Office 2019 for 64-bit editions

Microsoft Office 2019 for Mac

修復(fù)方案

方法一：

在windows的安全中心進(jìn)行在線下載安裝更新補(bǔ)??；

方法二：

由于系統(tǒng)環(huán)境以及網(wǎng)絡(luò)環(huán)境的原因，方法一（在線更新）可能會(huì)出現(xiàn)升級(jí)失敗的問(wèn)題，可以點(diǎn)擊瀏覽官方公告，然后點(diǎn)擊更新名稱跳轉(zhuǎn)到微軟官方的下載頁(yè)面，之后下載安全更新獨(dú)立程序包進(jìn)行安裝。

官方公告：

https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/2020-May

北京金山云網(wǎng)絡(luò)技術(shù)有限公司

2020/5/14