Operating System:

[WIN]

Published:

12 June 2019

Protect yourself against future threats.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2019.0160
               Microsoft Internet Explorer Security Updates
                               12 June 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Microsoft Internet Explorer
Operating System:     Windows
Impact/Access:        Execute Arbitrary Code/Commands -- Remote with User Interaction
                      Provide Misleading Information  -- Remote/Unauthenticated      
                      Access Confidential Data        -- Remote with User Interaction
                      Unauthorised Access             -- Remote with User Interaction
Resolution:           Patch/Upgrade
CVE Names:            CVE-2019-1081 CVE-2019-1080 CVE-2019-1055
                      CVE-2019-1038 CVE-2019-1005 CVE-2019-0995
                      CVE-2019-0988 CVE-2019-0940 CVE-2019-0930
                      CVE-2019-0929 CVE-2019-0921 CVE-2019-0920
                      CVE-2019-0918 CVE-2019-0911 CVE-2019-0884
Member content until: Friday, July 12 2019
Reference:            ASB-2019.0142
                      ASB-2019.0141
                      ASB-2019.0139
                      ESB-2019.1895

OVERVIEW

        Microsoft has released its monthly security patch update for the month of June 2019.
        
        This update resolves 15 vulnerabilities across the following products: [1]
        
         Internet Explorer 10
         Internet Explorer 11
         Internet Explorer 9


IMPACT

        Microsoft has given the following details regarding these vulnerabilities.
        
         Details         Impact                   Severity
         CVE-2019-0884   Remote Code Execution    Critical
         CVE-2019-0911   Remote Code Execution    Critical
         CVE-2019-0918   Remote Code Execution    Critical
         CVE-2019-0920   Remote Code Execution    Critical
         CVE-2019-0921   Spoofing                 Important
         CVE-2019-0929   Remote Code Execution    Critical
         CVE-2019-0930   Information Disclosure   Important
         CVE-2019-0940   Remote Code Execution    Critical
         CVE-2019-0988   Remote Code Execution    Critical
         CVE-2019-0995   Security Feature Bypass  Important
         CVE-2019-1005   Remote Code Execution    Important
         CVE-2019-1038   Remote Code Execution    Critical
         CVE-2019-1055   Remote Code Execution    Critical
         CVE-2019-1080   Remote Code Execution    Critical
         CVE-2019-1081   Information Disclosure   Important


MITIGATION

        Microsoft recommends updating the software with the version made available 
        on the Microsoft Update Cataloge for the following Knowledge Base articles.
        [1].
        
        
         KB4503276, KB4503273, KB4503279, KB4503259, KB4499181
         KB4499149, KB4503290, KB4503291, KB4503292, KB4503293
         KB4499179, KB4503327, KB4499171, KB4499154, KB4499151
         KB4498206, KB4503267, KB4494440, KB4494441, KB4497936
         KB4503287, KB4503286, KB4503285, KB4503284, KB4499167
         KB4499164


REFERENCES

        [1] Security Update Guide
            https://portal.msrc.microsoft.com/en-us/security-guidance

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXQCciWaOgq3Tt24GAQhUVxAAlBE9cTloe2o/GcOpOU6rMdOgklR2ilTE
1PCqLV7uz6lSN9xDozclfV7m1sMvIDhywFDkywN+AJriQ7gUG9TWeeFlo6EkdUWN
EdarQp+F2UNXZlOrxUw+bkssZYBPruXnNChwPmCtuR+1MIn56WZJEGrBjV+WVc8C
sTTvsOFfEs34L+YF6jzgFqkQG6mk95g3iqhzbs1hJTFul0k5i8zIBxGPKv4m+t/i
DoB0nepfJPaZaIia7KH4wJwe2Z2va90ptqeqqF9fB+Pi18SKMpuBG/iXGoMRq9YO
1TXo5uBxWyGj+rPIxwdnSnb+3leaQhiL85dM0NVg1xULspsxxSU2mu41yoYgVLKL
xS87n6KFCgXDfrym2G/CBYAPwoFoCKIi+MOVlVKPjYXRDX9/RkYuezoFYV/Z8ayX
t2cxUaP1ZzJlITxDh9HHTFhzv7wD70uQExsTl2TDJ8Yq1YdL8JFtCa/NoXkHeznv
4itScrzwEAb4n26AlljqysqQKw5tylNgrpKme8d7fKn7LbzLXH9PhH/+sxwbo/23
tGfkM1ITr25kPqw+BgtVBUaA5NTLyfoKj5GVYRLPighQ6xz6gAgOwPMJFrHxcjaK
4f0Ahuow0dbmHxxMkXGRX7+MWrYTsOVmeIhCWHzdCnmMr6SBb2wixMhPlvGQpCy2
FuWOIHexFP4=
=juPa
-----END PGP SIGNATURE-----