Security
Headlines
HeadlinesLatestCVEs

Tag

#microsoft

CVE-2022-47213: Microsoft Office Graphics Remote Code Execution Vulnerability

**Is the Preview Pane an attack vector for this vulnerability?** No, the Preview Pane is not an attack vector.

Microsoft Security Response Center
Open in Source
#vulnerability#web#microsoft#rce#Microsoft Graphics Component#Security Vulnerability
CVE-2022-44697: Windows Graphics Component Elevation of Privilege Vulnerability

**Why are there two different impacts in the Security Updates table?** An attacker could potentially exploit this vulnerability to elevate privileges from a client-side application sandbox in earlier Microsoft operating systems. However, mitigation technologies in later Microsoft operating systems make this more difficult. For this reason, this vulnerability has two different impact ratings.

CVE-2022-44696: Microsoft Office Visio Remote Code Execution Vulnerability

**According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?** The word **Remote** in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. The vulnerable endpoint is only available over the local VM interface as all external communication is blocked. This means an attacker needs to execute code from the local machine to exploit the vulnerability.

CVE-2022-44704: Microsoft Windows Sysmon Elevation of Privilege Vulnerability

**How could an attacker exploit this vulnerability?** A locally authenticated attacker could manipulate information on the Sysinternals services to achieve elevation from local user to SYSTEM admin.

CVE-2022-44695: Microsoft Office Visio Remote Code Execution Vulnerability

**According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?** The word **Remote** in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. The vulnerable endpoint is only available over the local VM interface as all external communication is blocked. This means an attacker needs to execute code from the local machine to exploit the vulnerability.

CVE-2022-44698: Windows SmartScreen Security Feature Bypass Vulnerability

**What is the relationship between Mark of the Web and Windows SmartScreen?** When you download a file from the internet, Windows adds the zone identifier or Mark of the Web as an NTFS stream to the file. So, when you run the file, Windows SmartScreen checks if there is a zone identifier Alternate Data Stream (ADS) attached to the file. If the ADS indicates ZoneId=3 which means that the file was downloaded from the internet, the SmartScreen does a reputation check. For more information on SmartScreen, please visit Microsoft Defender SmartScreen overview | Microsoft Learn.