Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2022-22018 (GCVE-0-2022-22018)
Vulnerability from cvelistv5 – Published: 2022-06-15 21:51 – Updated: 2025-01-02 19:02
VLAI?
EPSS
Summary
HEVC Video Extensions Remote Code Execution Vulnerability
Severity ?
CWE
- Remote Code Execution
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Microsoft | HEVC Video Extension |
Affected:
1.0.0.0 , < 2.0.51122.0
(custom)
|
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:00:54.951Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-22018"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"Unknown"
],
"product": "HEVC Video Extension",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "2.0.51122.0",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"Unknown"
],
"product": "HEVC Video Extensions",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "2.0.51121.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:hevc_video_extensions:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.51122.0",
"versionStartIncluding": "1.0.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:hevc_video_extensions:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.0.51121.0",
"versionStartIncluding": "1.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2022-06-14T07:00:00+00:00",
"descriptions": [
{
"lang": "en-US",
"value": "HEVC Video Extensions Remote Code Execution Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en-US",
"type": "Impact"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-02T19:02:47.939Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "HEVC Video Extensions Remote Code Execution Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22018"
}
],
"title": "HEVC Video Extensions Remote Code Execution Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2022-22018",
"datePublished": "2022-06-15T21:51:09",
"dateReserved": "2021-12-16T00:00:00",
"dateUpdated": "2025-01-02T19:02:47.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:microsoft:hevc_video_extensions:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"2.0.51121.0\", \"matchCriteriaId\": \"CE358136-3578-4A25-9220-9B363CF0D7EE\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"HEVC Video Extensions Remote Code Execution Vulnerability\"}, {\"lang\": \"es\", \"value\": \"Una Vulnerabilidad de Ejecuci\\u00f3n de C\\u00f3digo Remota en HEVC Video Extensions. Este ID de CVE es diferente de CVE-2022-29111, CVE-2022-29119, CVE-2022-30188\"}]",
"id": "CVE-2022-22018",
"lastModified": "2025-01-02T19:15:33.897",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"secure@microsoft.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:P\", \"baseScore\": 6.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
"published": "2022-06-15T22:15:12.947",
"references": "[{\"url\": \"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22018\", \"source\": \"secure@microsoft.com\"}, {\"url\": \"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-22018\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-22018\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2022-06-15T22:15:12.947\",\"lastModified\":\"2025-01-02T19:15:33.897\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"HEVC Video Extensions Remote Code Execution Vulnerability\"},{\"lang\":\"es\",\"value\":\"Una Vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota en HEVC Video Extensions. Este ID de CVE es diferente de CVE-2022-29111, CVE-2022-29119, CVE-2022-30188\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"baseScore\":6.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:hevc_video_extensions:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.0.51121.0\",\"matchCriteriaId\":\"CE358136-3578-4A25-9220-9B363CF0D7EE\"}]}]}],\"references\":[{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22018\",\"source\":\"secure@microsoft.com\"},{\"url\":\"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-22018\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
}
}
MSRC_CVE-2022-22018
Vulnerability from csaf_microsoft - Published: 2022-06-14 07:00 - Updated: 2022-06-14 07:00Summary
HEVC Video Extensions Remote Code Execution Vulnerability
Notes
Additional Resources
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
Disclaimer
The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Customer Action
Required. The vulnerability documented by this CVE requires customer action to resolve.
{
"document": {
"acknowledgments": [
{
"names": [
"Dhanesh Kizhakkinan with Mandiant"
]
},
{
"names": [
"PeaceMaker"
]
}
],
"aggregate_severity": {
"namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
},
{
"category": "general",
"text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
"title": "Customer Action"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2022-22018 HEVC Video Extensions Remote Code Execution Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22018"
},
{
"category": "self",
"summary": "CVE-2022-22018 HEVC Video Extensions Remote Code Execution Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/csaf/2022/msrc_cve-2022-22018.json"
},
{
"category": "external",
"summary": "Microsoft Exploitability Index",
"url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "HEVC Video Extensions Remote Code Execution Vulnerability",
"tracking": {
"current_release_date": "2022-06-14T07:00:00.000Z",
"generator": {
"date": "2025-01-02T19:02:47.063Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2022-22018",
"initial_release_date": "2022-06-14T07:00:00.000Z",
"revision_history": [
{
"date": "2022-06-14T07:00:00.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c2.0.51122.0",
"product": {
"name": "HEVC Video Extension \u003c2.0.51122.0",
"product_id": "1"
}
},
{
"category": "product_version",
"name": "2.0.51122.0",
"product": {
"name": "HEVC Video Extension 2.0.51122.0",
"product_id": "12010"
}
}
],
"category": "product_name",
"name": "HEVC Video Extension"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c2.0.51121.0",
"product": {
"name": "HEVC Video Extensions \u003c2.0.51121.0",
"product_id": "2"
}
},
{
"category": "product_version",
"name": "2.0.51121.0",
"product": {
"name": "HEVC Video Extensions 2.0.51121.0",
"product_id": "11808"
}
}
],
"category": "product_name",
"name": "HEVC Video Extensions"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-22018",
"notes": [
{
"category": "general",
"text": "Microsoft",
"title": "Assigning CNA"
},
{
"category": "faq",
"text": "The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.\nFor example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.",
"title": "According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?"
},
{
"category": "faq",
"text": "HEVC Video Extension is available to consumers and HEVC Video Extensions is used by device OEMs.",
"title": "What is the difference between HEVC Video Extension and HEVC Video Extensions?"
},
{
"category": "faq",
"text": "If your device manufacturer preinstalled this app, package versions 2.0.51121.0 and later contain this update.\nIf you purchased this app from the Microsoft Store, package versions 2.0.51122.0 and later contain this update.\nYou can check the package version in PowerShell:\nGet-AppxPackage -Name Microsoft.HEVCVideoExtension*",
"title": "How can I check if the update is installed?"
},
{
"category": "faq",
"text": "No. Only customers who have installed the optional HEVC or \u0026quot;HEVC from Device Manufacturer\u0026quot; media codecs from Microsoft Store may be vulnerable.\nAffected customers will be automatically updated by Microsoft Store. Customers do not need to take any action to receive the update.\nAlternatively, customers who want to receive the update immediately can check for updates with the Microsoft Store App; more information on this process can be found here.\nThese updates are for optional apps/components that are offered to customers as a download via the Microsoft Store. Updates for optional store apps/components are provided via the Microsoft Store.\nHEVC is not available for offline distribution and not supported on Windows Server. Users should not have it installed in these environments. Enterprise customers using Store for Business will receive the update in the same manner as consumer Store.\nServicing for store apps/components does not follow the monthly \u201cUpdate Tuesday\u201d cadence, but are offered whenever necessary.\nYes. However, it is possible to turn off automatic updating for store apps. In that scenario, these updates would not be installed automatically.\nThe following command will display the version of the installed package:\nGet-AppxPackage -Name Microsoft.HEVCVideoExtension*",
"title": "Is Windows vulnerable in the default configuration?"
}
],
"product_status": {
"fixed": [
"11808",
"12010"
],
"known_affected": [
"1",
"2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-22018 HEVC Video Extensions Remote Code Execution Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22018"
},
{
"category": "self",
"summary": "CVE-2022-22018 HEVC Video Extensions Remote Code Execution Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22018"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2022-06-14T07:00:00.000Z",
"details": "2.0.51122.0:Security Update:https://support.microsoft.com/en-us/account-billing/get-updates-for-apps-and-games-in-microsoft-store-a1fe19c0-532d-ec47-7035-d1c5a1dd464f",
"product_ids": [
"1"
],
"url": "https://support.microsoft.com/en-us/account-billing/get-updates-for-apps-and-games-in-microsoft-store-a1fe19c0-532d-ec47-7035-d1c5a1dd464f"
},
{
"category": "vendor_fix",
"date": "2022-06-14T07:00:00.000Z",
"details": "2.0.51121.0:Security Update:https://support.microsoft.com/en-us/account-billing/get-updates-for-apps-and-games-in-microsoft-store-a1fe19c0-532d-ec47-7035-d1c5a1dd464f",
"product_ids": [
"2"
],
"url": "https://support.microsoft.com/en-us/account-billing/get-updates-for-apps-and-games-in-microsoft-store-a1fe19c0-532d-ec47-7035-d1c5a1dd464f"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"environmentalsScore": 0.0,
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 6.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Remote Code Execution"
},
{
"category": "exploit_status",
"details": "Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely"
}
],
"title": "HEVC Video Extensions Remote Code Execution Vulnerability"
}
]
}
GHSA-J86W-GJWH-M6F6
Vulnerability from github – Published: 2022-06-16 00:00 – Updated: 2025-01-02 21:31
VLAI?
Details
HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-29111, CVE-2022-29119, CVE-2022-30188.
Severity ?
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-22018"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-15T22:15:00Z",
"severity": "HIGH"
},
"details": "HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-29111, CVE-2022-29119, CVE-2022-30188.",
"id": "GHSA-j86w-gjwh-m6f6",
"modified": "2025-01-02T21:31:36Z",
"published": "2022-06-16T00:00:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-22018"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22018"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-22018"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
CERTFR-2022-AVI-559
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et une exécution de code à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (CU 29) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | Azure | Azure Automation State Configuration, DSC Extension | ||
| Microsoft | N/A | System Center Operations Manager (SCOM) 2016 | ||
| Microsoft | Azure | Azure Automation Update Management | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.2 | ||
| Microsoft | N/A | NuGet.exe | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4) | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | ||
| Microsoft | Azure | Azure Diagnostics (LAD) | ||
| Microsoft | N/A | HEVC Video Extensions | ||
| Microsoft | Azure | Azure Real Time Operating System GUIX | ||
| Microsoft | Azure | Azure Service Fabric | ||
| Microsoft | Azure | Azure Security Center | ||
| Microsoft | N/A | Container Monitoring Solution | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4) | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | AV1 Video Extension | ||
| Microsoft | N/A | System Center Operations Manager (SCOM) 2019 | ||
| Microsoft | N/A | Visual Studio 2022 pour Mac version 17.0 | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Visual Studio 2019 pour Mac version 8.10 | ||
| Microsoft | Azure | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connectivity Pack | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | HEVC Video Extension | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (GDR) | ||
| Microsoft | Azure | Azure Real Time Operating System | ||
| Microsoft | N/A | Log Analytics Agent | ||
| Microsoft | N/A | Microsoft Photos | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 2 (CU 17) | ||
| Microsoft | Azure | Azure Stack Hub | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 2 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (CU 16) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR) | ||
| Microsoft | Azure | Azure Open Management Infrastructure | ||
| Microsoft | N/A | System Center Operations Manager (SCOM) 2022 | ||
| Microsoft | Azure | Azure Sentinel |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 29)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Automation State Configuration, DSC Extension",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "System Center Operations Manager (SCOM) 2016",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Automation Update Management",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet.exe",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Diagnostics (LAD)",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HEVC Video Extensions",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Real Time Operating System GUIX",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Service Fabric",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Security Center",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Container Monitoring Solution",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "AV1 Video Extension",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "System Center Operations Manager (SCOM) 2019",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio 2022 pour Mac version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio 2019 pour Mac version 8.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 Azure Connectivity Pack",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HEVC Video Extension",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Real Time Operating System",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Log Analytics Agent",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Photos",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 2 (CU 17)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Stack Hub",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 2 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 16)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Open Management Infrastructure",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "System Center Operations Manager (SCOM) 2022",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Sentinel",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-30137",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30137"
},
{
"name": "CVE-2022-29119",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29119"
},
{
"name": "CVE-2022-30167",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30167"
},
{
"name": "CVE-2022-29111",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29111"
},
{
"name": "CVE-2022-30188",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30188"
},
{
"name": "CVE-2022-22018",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22018"
},
{
"name": "CVE-2022-29149",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29149"
},
{
"name": "CVE-2022-30178",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30178"
},
{
"name": "CVE-2022-29143",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29143"
},
{
"name": "CVE-2022-30179",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30179"
},
{
"name": "CVE-2022-30168",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30168"
},
{
"name": "CVE-2022-30193",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30193"
},
{
"name": "CVE-2022-30180",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30180"
},
{
"name": "CVE-2022-30184",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30184"
},
{
"name": "CVE-2022-30177",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30177"
},
{
"name": "CVE-2022-30174",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30174"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30193 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30193"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-29143 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29143"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30188 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30188"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-29119 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29119"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-22018 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22018"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30137 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30137"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30167 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30167"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30168 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30168"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30180 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30180"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30174 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30174"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30184 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30184"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-29149 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29149"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30178 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30178"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30177 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30177"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-29111 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29111"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30179 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30179"
}
],
"reference": "CERTFR-2022-AVI-559",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-06-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es et une ex\u00e9cution de code \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2022-AVI-559
Vulnerability from certfr_avis - Published: - Updated:
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et une exécution de code à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (CU 29) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | Azure | Azure Automation State Configuration, DSC Extension | ||
| Microsoft | N/A | System Center Operations Manager (SCOM) 2016 | ||
| Microsoft | Azure | Azure Automation Update Management | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.2 | ||
| Microsoft | N/A | NuGet.exe | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4) | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8) | ||
| Microsoft | Azure | Azure Diagnostics (LAD) | ||
| Microsoft | N/A | HEVC Video Extensions | ||
| Microsoft | Azure | Azure Real Time Operating System GUIX | ||
| Microsoft | Azure | Azure Service Fabric | ||
| Microsoft | Azure | Azure Security Center | ||
| Microsoft | N/A | Container Monitoring Solution | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4) | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | AV1 Video Extension | ||
| Microsoft | N/A | System Center Operations Manager (SCOM) 2019 | ||
| Microsoft | N/A | Visual Studio 2022 pour Mac version 17.0 | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Visual Studio 2019 pour Mac version 8.10 | ||
| Microsoft | Azure | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connectivity Pack | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | HEVC Video Extension | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (GDR) | ||
| Microsoft | Azure | Azure Real Time Operating System | ||
| Microsoft | N/A | Log Analytics Agent | ||
| Microsoft | N/A | Microsoft Photos | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 2 (CU 17) | ||
| Microsoft | Azure | Azure Stack Hub | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 2 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (CU 16) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR) | ||
| Microsoft | Azure | Azure Open Management Infrastructure | ||
| Microsoft | N/A | System Center Operations Manager (SCOM) 2022 | ||
| Microsoft | Azure | Azure Sentinel |
References
| Title | Publication Time | Tags | |||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 29)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Automation State Configuration, DSC Extension",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "System Center Operations Manager (SCOM) 2016",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Automation Update Management",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "NuGet.exe",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.9 (includes 16.0 - 16.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Diagnostics (LAD)",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HEVC Video Extensions",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Real Time Operating System GUIX",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Service Fabric",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Security Center",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Container Monitoring Solution",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "AV1 Video Extension",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "System Center Operations Manager (SCOM) 2019",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio 2022 pour Mac version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Visual Studio 2019 pour Mac version 8.10",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 Azure Connectivity Pack",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HEVC Video Extension",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Real Time Operating System",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Log Analytics Agent",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Photos",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 2 (CU 17)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Stack Hub",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 2 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 16)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Open Management Infrastructure",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "System Center Operations Manager (SCOM) 2022",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Azure Sentinel",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2022-30137",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30137"
},
{
"name": "CVE-2022-29119",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29119"
},
{
"name": "CVE-2022-30167",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30167"
},
{
"name": "CVE-2022-29111",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29111"
},
{
"name": "CVE-2022-30188",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30188"
},
{
"name": "CVE-2022-22018",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-22018"
},
{
"name": "CVE-2022-29149",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29149"
},
{
"name": "CVE-2022-30178",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30178"
},
{
"name": "CVE-2022-29143",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-29143"
},
{
"name": "CVE-2022-30179",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30179"
},
{
"name": "CVE-2022-30168",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30168"
},
{
"name": "CVE-2022-30193",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30193"
},
{
"name": "CVE-2022-30180",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30180"
},
{
"name": "CVE-2022-30184",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30184"
},
{
"name": "CVE-2022-30177",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30177"
},
{
"name": "CVE-2022-30174",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-30174"
}
],
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30193 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30193"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-29143 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29143"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30188 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30188"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-29119 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29119"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-22018 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22018"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30137 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30137"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30167 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30167"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30168 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30168"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30180 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30180"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30174 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30174"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30184 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30184"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-29149 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29149"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30178 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30178"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30177 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30177"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-29111 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29111"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-30179 du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30179"
}
],
"reference": "CERTFR-2022-AVI-559",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2022-06-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es et une ex\u00e9cution de code \u00e0 distance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 14 juin 2022",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CNVD-2022-59677
Vulnerability from cnvd - Published: 2022-08-25
VLAI Severity ?
Title
Microsoft HEVC Video Extensions远程代码执行漏洞（CNVD-2022-59677）
Description
Microsoft HEVC Video Extensions是美国微软（Microsoft）公司的一个视频扩展应用程序。该应用使计算机和设备可以读取高效视频编码或HEVC视频。
Microsoft HEVC Video Extensions存在远程代码执行漏洞，攻击者可利用该漏洞在系统上执行任意代码。
Severity
中
Patch Name
Microsoft HEVC Video Extensions远程代码执行漏洞（CNVD-2022-59677）的补丁
Patch Description
Microsoft HEVC Video Extensions是美国微软（Microsoft）公司的一个视频扩展应用程序。该应用使计算机和设备可以读取高效视频编码或HEVC视频。
Microsoft HEVC Video Extensions存在远程代码执行漏洞，攻击者可利用该漏洞在系统上执行任意代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-22018
Reference
https://nvd.nist.gov/vuln/detail/CVE-2022-22018
Impacted products
| Name | ['Microsoft HEVC Video Extensions', 'Microsoft HEVC Video Extension'] |
|---|
{
"cves": {
"cve": {
"cveNumber": "CVE-2022-22018",
"cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-22018"
}
},
"description": "Microsoft HEVC Video Extensions\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u89c6\u9891\u6269\u5c55\u5e94\u7528\u7a0b\u5e8f\u3002\u8be5\u5e94\u7528\u4f7f\u8ba1\u7b97\u673a\u548c\u8bbe\u5907\u53ef\u4ee5\u8bfb\u53d6\u9ad8\u6548\u89c6\u9891\u7f16\u7801\u6216HEVC\u89c6\u9891\u3002\n\nMicrosoft HEVC Video Extensions\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-22018",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2022-59677",
"openTime": "2022-08-25",
"patchDescription": "Microsoft HEVC Video Extensions\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u89c6\u9891\u6269\u5c55\u5e94\u7528\u7a0b\u5e8f\u3002\u8be5\u5e94\u7528\u4f7f\u8ba1\u7b97\u673a\u548c\u8bbe\u5907\u53ef\u4ee5\u8bfb\u53d6\u9ad8\u6548\u89c6\u9891\u7f16\u7801\u6216HEVC\u89c6\u9891\u3002\r\n\r\nMicrosoft HEVC Video Extensions\u5b58\u5728\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Microsoft HEVC Video Extensions\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2022-59677\uff09\u7684\u8865\u4e01",
"products": {
"product": [
"Microsoft HEVC Video Extensions",
"Microsoft HEVC Video Extension"
]
},
"referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2022-22018",
"serverity": "\u4e2d",
"submitTime": "2022-06-17",
"title": "Microsoft HEVC Video Extensions\u8fdc\u7a0b\u4ee3\u7801\u6267\u884c\u6f0f\u6d1e\uff08CNVD-2022-59677\uff09"
}
GSD-2022-22018
Vulnerability from gsd - Updated: 2023-12-13 01:19Details
HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-29111, CVE-2022-29119, CVE-2022-30188.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2022-22018",
"description": "HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-29111, CVE-2022-29119, CVE-2022-30188.",
"id": "GSD-2022-22018"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2022-22018"
],
"details": "HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-29111, CVE-2022-29119, CVE-2022-30188.",
"id": "GSD-2022-22018",
"modified": "2023-12-13T01:19:29.093694Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2022-22018",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "HEVC Video Extension",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.0.0",
"version_value": "2.0.51122.0"
}
]
}
},
{
"product_name": "HEVC Video Extensions",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.0.0",
"version_value": "2.0.51121.0"
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "HEVC Video Extensions Remote Code Execution Vulnerability"
}
]
},
"impact": {
"cvss": [
{
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-22018",
"refsource": "MISC",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-22018"
}
]
}
},
"nvd.nist.gov": {
"cve": {
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:hevc_video_extensions:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CE358136-3578-4A25-9220-9B363CF0D7EE",
"versionEndExcluding": "2.0.51121.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "HEVC Video Extensions Remote Code Execution Vulnerability"
},
{
"lang": "es",
"value": "Una Vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota en HEVC Video Extensions. Este ID de CVE es diferente de CVE-2022-29111, CVE-2022-29119, CVE-2022-30188"
}
],
"id": "CVE-2022-22018",
"lastModified": "2023-12-21T00:15:11.850",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Primary"
}
]
},
"published": "2022-06-15T22:15:12.947",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-22018"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
}
}
}
FKIE_CVE-2022-22018
Vulnerability from fkie_nvd - Published: 2022-06-15 22:15 - Updated: 2025-01-02 19:15
Severity ?
Summary
HEVC Video Extensions Remote Code Execution Vulnerability
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microsoft | hevc_video_extensions | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:hevc_video_extensions:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CE358136-3578-4A25-9220-9B363CF0D7EE",
"versionEndExcluding": "2.0.51121.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "HEVC Video Extensions Remote Code Execution Vulnerability"
},
{
"lang": "es",
"value": "Una Vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota en HEVC Video Extensions. Este ID de CVE es diferente de CVE-2022-29111, CVE-2022-29119, CVE-2022-30188"
}
],
"id": "CVE-2022-22018",
"lastModified": "2025-01-02T19:15:33.897",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "secure@microsoft.com",
"type": "Secondary"
}
]
},
"published": "2022-06-15T22:15:12.947",
"references": [
{
"source": "secure@microsoft.com",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22018"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-22018"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…