Yesterday, Microsoft released its November 2019 Patch Tuesday. One of the most important elements of this patch is the correction of a security , specifically a vulnerability in Internet Explorer, which malicious hackers and were exploiting.
The vulnerability is called CVE-2019-1429. According to Microsoft, it allows attackers to execute code remotely because of a flaw in “the way the scripting engine handles things in memory in Internet Explorer.”
Furthermore, the vulnerability is considered serious because the fact that it is in IE's scripting engine means that it affects many things (not just the browser).
The IE scripting engine is also used within Office Suite apps to display web content in embedded iframes. Therefore, if attackers exploit the vulnerability , they could create malicious Office documents and execute malicious code on the victim's system if the user allows content such as web-based inframes to be displayed . Therefore, the issue should have been addressed in the patch anyway
The zero-day vulnerability in IE was already being exploited by hackers. Three companies (iDefense Labs, Resecurity, and Google) were able to identify attacks related to this vulnerability.
However, the companies did not provide many details about their findings.
Most Windows zero-day vulnerabilities are typically exploited by government hacking groups, but recently they have also been exploited by smaller groups aiming for financial gain.
What other fixes does the new patch bring?
The IE zero-day vulnerability is the most significant issue fixed by the patch. However, the new patch fixes 74 other bugs across nine Microsoft products/platforms.
An important fix concerns Excel for Mac. A few days ago, a security issue was reported regarding the “Disable all macros” setting. This allowed XLM-based macros scripts to run when users opened an Excel spreadsheet, potentially exposing them to attack.
Additionally, the patch includes advice for addressing a mysterious vulnerability present in some Trusted Platform Module (TPM) chipsets.
What vulnerabilities does the November 2019 Patch Tuesday fix? Here is the table, as provided by Microsoft:
| Tags | CVE ID | CVE Title |
| Servicing Stack Updates | ADV990001 | Latest Servicing Stack Updates |
| Chipsets | ADV190024 | Microsoft Guidance for Vulnerability in Trusted Platform Module (TPM) (TPM) |
| Azure Stack | CVE-2019-1234 | Azure Stack Spoofing Vulnerability |
| Graphic Fonts | CVE-2019-1456 | OpenType Font Parsing Remote Code Execution Vulnerability |
| Microsoft Edge | CVE-2019-1413 | Microsoft Edge Security Feature Bypass Vulnerability |
| Microsoft Exchange Server | CVE-2019-1373 | Microsoft Exchange Remote Code Execution Vulnerability |
| Microsoft Graphics Component | CVE-2019-1441 | Win32k Graphics Remote Code Execution Vulnerability |
| Microsoft Graphics Component | CVE-2019-1408 | Win32k Elevation of Privilege Vulnerability |
| Microsoft Graphics Component | CVE-2019-1439 | Windows GDI Information Disclosure Vulnerability |
| Microsoft Graphics Component | CVE-2019-1438 | Windows Graphics Component Elevation of Privilege Vulnerability |
| Microsoft Graphics Component | CVE-2019-1407 | Windows Graphics Component Elevation of Privilege Vulnerability |
| Microsoft Graphics Component | CVE-2019-1394 | Win32k Elevation of Privilege Vulnerability |
| Microsoft Graphics Component | CVE-2019-1393 | Win32k Elevation of Privilege Vulnerability |
| Microsoft Graphics Component | CVE-2019-1396 | Win32k Elevation of Privilege Vulnerability |
| Microsoft Graphics Component | CVE-2019-1395 | Win32k Elevation of Privilege Vulnerability |
| Microsoft Graphics Component | CVE-2019-1437 | Windows Graphics Component Elevation of Privilege Vulnerability |
| Microsoft Graphics Component | CVE-2019-1432 | DirectWrite Information Disclosure Vulnerability |
| Microsoft Graphics Component | CVE-2019-1411 | DirectWrite Information Disclosure Vulnerability |
| Microsoft Graphics Component | CVE-2019-1440 | Win32k Information Disclosure Vulnerability |
| Microsoft Graphics Component | CVE-2019-1419 | OpenType Font Parsing Remote Code Execution Vulnerability |
| Microsoft Graphics Component | CVE-2019-1433 | Windows Graphics Component Elevation of Privilege Vulnerability |
| Microsoft Graphics Component | CVE-2019-1436 | Win32k Information Disclosure Vulnerability |
| Microsoft Graphics Component | CVE-2019-1412 | OpenType Font Driver Information Disclosure Vulnerability |
| Microsoft Graphics Component | CVE-2019-1434 | Win32k Elevation of Privilege Vulnerability |
| Microsoft Graphics Component | CVE-2019-1435 | Windows Graphics Component Elevation of Privilege Vulnerability |
| Microsoft JET Database Engine | CVE-2019-1406 | Jet Database Engine Remote Code Execution Vulnerability |
| Microsoft Office | CVE-2019-1445 | Microsoft Office Online Spoofing Vulnerability |
| Microsoft Office | CVE-2019-1449 | Microsoft Office ClickToRun Security Feature Bypass Vulnerability |
| Microsoft Office | CVE-2019-1446 | Microsoft Excel Information Disclosure Vulnerability |
| Microsoft Office | CVE-2019-1447 | Microsoft Office Online Spoofing Vulnerability |
| Microsoft Office | CVE-2019-1402 | Microsoft Office Information Disclosure Vulnerability |
| Microsoft Office | CVE-2019-1448 | Microsoft Excel Remote Code Execution Vulnerability |
| Microsoft Office | CVE-2019-1457 | Microsoft Office Excel Security Feature Bypass |
| Microsoft Office SharePoint | CVE-2019-1443 | Microsoft SharePoint Information Disclosure Vulnerability |
| Microsoft Office SharePoint | CVE-2019-1442 | Microsoft Office Security Feature Bypass Vulnerability |
| Microsoft RPC | CVE-2019-1409 | Windows Remote Procedure Call Information Disclosure Vulnerability |
| Microsoft Scripting Engine | CVE-2019-1426 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2019-1429 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2019-1427 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2019-1428 | Scripting Engine Memory Corruption Vulnerability |
| Microsoft Scripting Engine | CVE-2019-1390 | VBScript Remote Code Execution Vulnerability |
| Microsoft Windows | CVE-2019-1383 | Windows Data Sharing Service Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1418 | Windows Modules Installer Service Information Disclosure Vulnerability |
| Microsoft Windows | CVE-2018-12207 | Windows Denial of Service Vulnerability |
| Microsoft Windows | CVE-2019-1420 | Windows Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1417 | Windows Data Sharing Service Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1415 | Windows Installer Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1374 | Windows Error Reporting Information Disclosure Vulnerability |
| Microsoft Windows | CVE-2019-1422 | Windows Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1423 | Windows Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1424 | NetLogon Security Feature Bypass Vulnerability |
| Microsoft Windows | CVE-2019-1382 | Microsoft ActiveX Installer Service Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1385 | Windows AppX Deployment Extensions Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1380 | Microsoft splwow64 Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1388 | Windows Certificate Dialog Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1391 | Windows Denial of Service Vulnerability |
| Microsoft Windows | CVE-2019-1384 | Microsoft Windows Security Feature Bypass Vulnerability |
| Microsoft Windows | CVE-2019-1405 | Windows UPnP Service Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1381 | Microsoft Windows Information Disclosure Vulnerability |
| Microsoft Windows | CVE-2019-1379 | Windows Data Sharing Service Elevation of Privilege Vulnerability |
| Microsoft Windows | CVE-2019-1324 | Windows TCP/IP Information Disclosure Vulnerability |
| Open Source Software | CVE-2019-1370 | Open Enclave SDK Information Disclosure Vulnerability |
| Visual Studio | CVE-2019-1425 | Visual Studio Elevation of Privilege Vulnerability |
| Windows Hyper-V | CVE-2019-1398 | Windows Hyper-V Remote Code Execution Vulnerability |
| Windows Hyper-V | CVE-2019-1310 | Windows Hyper-V Denial of Service Vulnerability |
| Windows Hyper-V | CVE-2019-0719 | Hyper-V Remote Code Execution Vulnerability |
| Windows Hyper-V | CVE-2019-1399 | Windows Hyper-V Denial of Service Vulnerability |
| Windows Hyper-V | CVE-2019-1397 | Windows Hyper-V Remote Code Execution Vulnerability |
| Windows Hyper-V | CVE-2019-0712 | Windows Hyper-V Denial of Service Vulnerability |
| Windows Hyper-V | CVE-2019-0721 | Hyper-V Remote Code Execution Vulnerability |
| Windows Hyper-V | CVE-2019-1389 | Windows Hyper-V Remote Code Execution Vulnerability |
| Windows Hyper-V | CVE-2019-1309 | Windows Hyper-V Denial of Service Vulnerability |
| Windows Kernel | CVE-2019-1392 | Windows Kernel Elevation of Privilege Vulnerability |
| Windows Kernel | CVE-2019-11135 | Windows Kernel Information Disclosure Vulnerability |
| Windows Media Player | CVE-2019-1430 | Microsoft Windows Media Foundation Remote Code Execution Vulnerability |
| Windows Subsystem for Linux | CVE-2019-1416 | Windows Subsystem for Linux Elevation of Privilege Vulnerability |
