CVE-2020-0908— Windows Text Service Module Remote Code Execution Vulnerability

Windows Text Service Module Remote Code Execution Vulnerability

<p>A remote code execution vulnerability exists when the Windows Text Service Module improperly handles memory. An attacker who successfully exploited the vulnerability could gain execution on a victim system.</p> <p>An attacker could host a specially crafted website that is designed to exploit the vulnerability through Microsoft Edge (Chromium-based), and then convince a user to view the website. The attacker could also take advantage of compromised websites and websites that accept or host user-provided content or advertisements by adding specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by way of enticement in an email or Instant Messenger message, or by getting them to open an attachment sent through email.</p> <p>The security update addresses the vulnerability by correcting how the Windows Text Service Module handles memory.</p>

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

N/A

Microsoft Windows 缓冲区错误漏洞

Microsoft Windows是美国微软（Microsoft）公司的一种桌面操作系统。 Microsoft Windows Text Service Module 中存在缓冲区错误漏洞，该漏洞允许攻击者在受影响系统上获得执行代码权限。以下产品及版本受到影响： Windows 10 1909版本， Windows 10 1709版本， Windows Server 1909版本， Windows Server 1903版本， Windows Server 2004版本， Windows 10 2004版

N/A

N/A