Microsoft CVE-2019-0985: Microsoft Speech API Remote Code Execution Vulnerability
Description
A remote code execution vulnerability exists when the Microsoft Speech API (SAPI) improperly handles text-to-speech (TTS) input. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. To exploit the vulnerability, an attacker would need to convince a user to open a specially crafted document containing TTS content invoked through a scripting language. The update address the vulnerability by modifying how the system handles objects in memory.
Solution(s)
- msft-kb4503269-1cdbe639-c27c-4ac7-9343-f9bf1604f686
- msft-kb4503269-2ab80a73-82cd-43ce-a721-9bdf2efe53cb
- msft-kb4503269-358b582d-4bc3-413a-8b92-8bcf4353a820
- msft-kb4503269-3c4860d8-79ae-4d88-b2ea-5514f6cff025
- msft-kb4503269-48d42c58-c168-47e3-b5b9-fa8b78b0ae33
- msft-kb4503269-af9ce13b-08ae-4959-9ba1-cbfb91fb4189
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center