CVE-2019-1251 — Sensitive Information Exposure in Windows Server 2019

CWE-200 — Sensitive Information Exposure7 documents3 sources
Severity
6.5MEDIUMNVD
NVD5.5
EPSS
1.5%
top 19.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
26
Microsoft WindowsMicrosoft Windows 10 Version 1903 FOR 32-bit SystemsMicrosoft Windows 10 Version 1903 FOR Arm64-based Systems+23 more
Timeline
PublishedSep 11
Latest updateMay 24

Description

An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1244, CVE-2019-1245.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages24 packages

▶CVEListV5microsoft/windows11 versions+10
▶NVDmicrosoft/windowsr2, 1803, 1903+2
▶NVDmicrosoft/windows_106 versions+5
▶CVEListV5microsoft/windows_server2019, 2019 (Core installation), version 1803 (Core Installation)+2

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-qv24-5wr9-m3mp: An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosu↗2022-05-24
▶
GHSA
GHSA-9cxx-2gq5-4v8r: An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosu↗2022-05-24
▶
GHSA
GHSA-hvm5-44j4-v5j4: An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosu↗2022-05-24
▶

📋Vendor Advisories

1
Microsoft
DirectWrite Information Disclosure Vulnerability↗2019-09-10
▶
CVE-2019-1251 — Sensitive Information Exposure | cvebase