CVE-2019-1102 — Static Code Injection in Microsoft Windows

CWE-96 — Static Code Injection6 documents6 sources
Severity
8.8HIGHNVD
EPSS
24.7%
top 3.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
25
Microsoft WindowsMicrosoft Windows 10 Version 1903 FOR 32-bit SystemsMicrosoft Windows 10 Version 1903 FOR Arm64-based Systems+22 more
Timeline
PublishedJul 15
Latest updateMay 24

Description

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages23 packages

▶CVEListV5microsoft/windows19 versions+18
▶NVDmicrosoft/windowsr2, 1803, 1903+2

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-wm3m-h3w4-3ghf: A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remo↗2022-05-24
▶

📋Vendor Advisories

2
Microsoft
GDI+ Remote Code Execution Vulnerability↗2019-07-09
▶
Red Hat
jenkins-plugin-token-macro: Recursive token expansion results in information disclosure and DoS in Token Macro Plugin (SECURITY-1102)↗2019-01-28
▶

🕵️Threat Intelligence

1
Tenable
Microsoft’s July 2019 Patch Tuesday: What You Need to Know↗2019-07-09
▶

💬Community

1
Bugzilla
CVE-2019-1003011 jenkins-plugin-token-macro: Recursive token expansion results in information disclosure and DoS in Token Macro Plugin (SECURITY-1102)↗2019-01-29
▶
CVE-2019-1102 — Static Code Injection in Microsoft | cvebase