Home » Security Bloggers Network » VERT Threat Alert: January 2019 Patch Tuesday Analysis

VERT Threat Alert: January 2019 Patch Tuesday Analysis

by Tyler Reguly on January 8, 2019

Today’s VERT Alert addresses Microsoft’s January 2019 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-812 on Wednesday, January 9th.

In-The-Wild & Disclosed CVEs

CVE-2019-0579

The Windows Jet Database Engine improperly handles objects in memory and, if an attacker can convince a victim to open a malicious file, exploitation of this vulnerability could lead to code execution.

Microsoft has rated this as a 3 on the Exploitability Index (Exploitation Unlikely).

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis.

Tag	CVE Count	CVEs
Windows Hyper-V	2	CVE-2019-0550, CVE-2019-0551
Microsoft Edge	2	CVE-2019-0565, CVE-2019-0566
Windows Subsystem for Linux	11	CVE-2019-0538, CVE-2019-0575, CVE-2019-0576, CVE-2019-0577, CVE-2019-0578, CVE-2019-0579, CVE-2019-0580, CVE-2019-0581, CVE-2019-0582, CVE-2019-0583, CVE-2019-0584
ASP.NET	2	CVE-2019-0548, CVE-2019-0564
Microsoft Windows	6	CVE-2019-0543, CVE-2019-0570, CVE-2019-0571, CVE-2019-0572, CVE-2019-0573, CVE-2019-0574
.NET Framework	1	CVE-2019-0545
Windows COM	1	CVE-2019-0552
Visual Studio	2	CVE-2019-0537, CVE-2019-0546
Windows Kernel	4	CVE-2019-0536, CVE-2019-0549, CVE-2019-0554, CVE-2019-0569
Windows DHCP Client	1	CVE-2019-0547
Microsoft Exchange Server	2	CVE-2019-0586, CVE-2019-0588
Internet Explorer	1	CVE-2019-0541
Microsoft XML	1	CVE-2019-0555
Android App	1	CVE-2019-0622
Microsoft Office	4	CVE-2019-0585, CVE-2019-0559, CVE-2019-0560, CVE-2019-0561
Microsoft Scripting Engine	3	CVE-2019-0539, CVE-2019-0567, CVE-2019-0568
Microsoft Office SharePoint	4	CVE-2019-0556, CVE-2019-0557, CVE-2019-0558, CVE-2019-0562

Other Information

In addition to the Microsoft vulnerabilities included in the January Security Guidance, a pair of Adobe bulletins are available today.

January 2019 Adobe Flash Update [ADV190001]

Microsoft released an update for Adobe Flash. This corresponds with Adobe Update APSB19-01. This is a non-security update and includes no new CVEs.

Security Bulletin for Adobe Acrobat and Reader [APSB19-02]

Adobe has released security updates for Adobe Acrobat and Reader. This includes fixes for 2 CVEs: CVE-2018-16011 and CVE-2018-16-18.

Tyler Reguly

Tyler Reguly is Associate Director, Security R&D at Fortra, responsible for overseeing a team of researchers that provide the security expertise for the company’s integrity and compliance monitoring solution. Tyler joined Fortra in 2022 when the company acquired Tripwire, where Tyler had been a part of the research team for more than fifteen years. In addition to security research, Tyler has worked closely with Fanshawe College, from which he graduated with a diploma in Computer Systems Technology, developing five courses including subjects like Advanced Hacker Techniques & Tactics, Hacking and Exploits, Malware Research, Evolving Technologies and Threats, and Python Programming. He has also taught all five courses that he developed on multiple occasions.

tyler-reguly has 119 posts and counting.See all posts by tyler-reguly