This report contains detail for the following vulnerabilities:
Tag | CVE ID | CVE Title |
---|---|---|
.NET and Visual Studio | CVE-2022-30184 | .NET and Visual Studio Information Disclosure Vulnerability |
Azure OMI | CVE-2022-29149 | Azure Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability |
Azure Real Time Operating System | CVE-2022-30179 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability |
Azure Real Time Operating System | CVE-2022-30178 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability |
Azure Real Time Operating System | CVE-2022-30180 | Azure RTOS GUIX Studio Information Disclosure Vulnerability |
Azure Real Time Operating System | CVE-2022-30177 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability |
Azure Service Fabric Container | CVE-2022-30137 | Azure Service Fabric Container Elevation of Privilege Vulnerability |
Intel | CVE-2022-21127 | Intel: CVE-2022-21127 Special Register Buffer Data Sampling Update (SRBDS Update) |
Intel | ADV220002 | Microsoft Guidance on Intel Processor MMIO Stale Data Vulnerabilities |
Intel | CVE-2022-21123 | Intel: CVE-2022-21123 Shared Buffers Data Read (SBDR) |
Intel | CVE-2022-21125 | Intel: CVE-2022-21125 Shared Buffers Data Sampling (SBDS) |
Intel | CVE-2022-21166 | Intel: CVE-2022-21166 Device Register Partial Write (DRPW) |
Microsoft Edge (Chromium-based) | CVE-2022-2011 | Chromium: CVE-2022-2011 Use after free in ANGLE |
Microsoft Edge (Chromium-based) | CVE-2022-2010 | Chromium: CVE-2022-2010 Out of bounds read in compositing |
Microsoft Edge (Chromium-based) | CVE-2022-2008 | Chromium: CVE-2022-2008 Out of bounds memory access in WebGL |
Microsoft Edge (Chromium-based) | CVE-2022-2007 | Chromium: CVE-2022-2007 Use after free in WebGPU |
Microsoft Edge (Chromium-based) | CVE-2022-22021 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
Microsoft Office | CVE-2022-30159 | Microsoft Office Information Disclosure Vulnerability |
Microsoft Office | CVE-2022-30171 | Microsoft Office Information Disclosure Vulnerability |
Microsoft Office | CVE-2022-30172 | Microsoft Office Information Disclosure Vulnerability |
Microsoft Office | CVE-2022-30174 | Microsoft Office Remote Code Execution Vulnerability |
Microsoft Office Excel | CVE-2022-30173 | Microsoft Excel Remote Code Execution Vulnerability |
Microsoft Office SharePoint | CVE-2022-30158 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
Microsoft Office SharePoint | CVE-2022-30157 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
Microsoft Windows ALPC | CVE-2022-30160 | Windows Advanced Local Procedure Call Elevation of Privilege Vulnerability |
Microsoft Windows Codecs Library | CVE-2022-29119 | HEVC Video Extensions Remote Code Execution Vulnerability |
Microsoft Windows Codecs Library | CVE-2022-30188 | HEVC Video Extensions Remote Code Execution Vulnerability |
Microsoft Windows Codecs Library | CVE-2022-30167 | AV1 Video Extension Remote Code Execution Vulnerability |
Microsoft Windows Codecs Library | CVE-2022-30193 | AV1 Video Extension Remote Code Execution Vulnerability |
Microsoft Windows Codecs Library | CVE-2022-29111 | HEVC Video Extensions Remote Code Execution Vulnerability |
Microsoft Windows Codecs Library | CVE-2022-22018 | HEVC Video Extensions Remote Code Execution Vulnerability |
Remote Volume Shadow Copy Service (RVSS) | CVE-2022-30154 | Microsoft File Server Shadow Copy Agent Service (RVSS) Elevation of Privilege Vulnerability |
Role: Windows Hyper-V | CVE-2022-30163 | Windows Hyper-V Remote Code Execution Vulnerability |
SQL Server | CVE-2022-29143 | Microsoft SQL Server Remote Code Execution Vulnerability |
Windows Ancillary Function Driver for WinSock | CVE-2022-30151 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability |
Windows App Store | CVE-2022-30168 | Microsoft Photos App Remote Code Execution Vulnerability |
Windows Autopilot | CVE-2022-30189 | Windows Autopilot Device Management and Enrollment Client Spoofing Vulnerability |
Windows Container Isolation FS Filter Driver | CVE-2022-30131 | Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability |
Windows Container Manager Service | CVE-2022-30132 | Windows Container Manager Service Elevation of Privilege Vulnerability |
Windows Defender | CVE-2022-30150 | Windows Defender Remote Credential Guard Elevation of Privilege Vulnerability |
Windows Encrypting File System (EFS) | CVE-2022-30145 | Windows Encrypting File System (EFS) Remote Code Execution Vulnerability |
Windows File History Service | CVE-2022-30142 | Windows File History Remote Code Execution Vulnerability |
Windows Installer | CVE-2022-30147 | Windows Installer Elevation of Privilege Vulnerability |
Windows iSCSI | CVE-2022-30140 | Windows iSCSI Discovery Service Remote Code Execution Vulnerability |
Windows Kerberos | CVE-2022-30164 | Kerberos AppContainer Security Feature Bypass Vulnerability |
Windows Kerberos | CVE-2022-30165 | Windows Kerberos Elevation of Privilege Vulnerability |
Windows Kernel | CVE-2022-30162 | Windows Kernel Information Disclosure Vulnerability |
Windows Kernel | CVE-2022-30155 | Windows Kernel Denial of Service Vulnerability |
Windows LDAP - Lightweight Directory Access Protocol | CVE-2022-30143 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability |
Windows LDAP - Lightweight Directory Access Protocol | CVE-2022-30161 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability |
Windows LDAP - Lightweight Directory Access Protocol | CVE-2022-30141 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability |
Windows LDAP - Lightweight Directory Access Protocol | CVE-2022-30153 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability |
Windows LDAP - Lightweight Directory Access Protocol | CVE-2022-30139 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability |
Windows LDAP - Lightweight Directory Access Protocol | CVE-2022-30149 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability |
Windows LDAP - Lightweight Directory Access Protocol | CVE-2022-30146 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability |
Windows Local Security Authority Subsystem Service | CVE-2022-30166 | Local Security Authority Subsystem Service Elevation of Privilege Vulnerability |
Windows Media | CVE-2022-30135 | Windows Media Center Elevation of Privilege Vulnerability |
Windows Network Address Translation (NAT) | CVE-2022-30152 | Windows Network Address Translation (NAT) Denial of Service Vulnerability |
Windows Network File System | CVE-2022-30136 | Windows Network File System Remote Code Execution Vulnerability |
Windows PowerShell | CVE-2022-30148 | Windows Desired State Configuration (DSC) Information Disclosure Vulnerability |
Windows SMB | CVE-2022-32230 | Windows SMB Denial of Service Vulnerability |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact |
CVE-2022-21166 MITRE NVD |
CVE Title: Intel: CVE-2022-21166 Device Register Partial Write (DRPW)
CVSS: None FAQ: Why is this Intel CVE included in the Security Update Guide? The vulnerability assigned to this CVE is in certain processor models offered by Intel. The mitigation for this vulnerability requires a firmware update, and a corresponding Windows updates enables the mitigation. This CVE is being documented in the Security Update Guide to announce that the latest builds of Windows enable the mitigation and are not vulnerable to the issue when paired with the firmware update. Please see the following for more information: Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Information Disclosure |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-21166 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 10 for 32-bit Systems | 5014710 (Security Update) | Important | Information Disclosure | 5013963 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 for x64-based Systems | 5014710 (Security Update) | Important | Information Disclosure | 5013963 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1607 for 32-bit Systems | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1607 for x64-based Systems | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1809 for 32-bit Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1809 for ARM64-based Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1809 for x64-based Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 20H2 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 20H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 20H2 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H1 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H1 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H1 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H2 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H2 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 11 for ARM64-based Systems | 5014697 (Security Update) | Important | Information Disclosure | 5013943 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 11 for x64-based Systems | 5014697 (Security Update) | Important | Information Disclosure | 5013943 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 7 for 32-bit Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 7 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 8.1 for 32-bit systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 8.1 for x64-based systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows RT 8.1 | 5014738 (Monthly Rollup) | Important | Information Disclosure | Base: N/A Temporal: N/A Vector: N/A |
Yes | |
Windows Server 2008 for 32-bit Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Information Disclosure | 5014017 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 (Server Core installation) | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Information Disclosure | 5014017 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 R2 | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 R2 (Server Core installation) | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2016 | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2016 (Server Core installation) | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2022 | 5014678 (Security Update) | Important | Information Disclosure | 5013944 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2022 (Server Core installation) | 5014678 (Security Update) | Important | Information Disclosure | 5013944 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server, version 20H2 (Server Core Installation) | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
CVE ID | Acknowledgements |
CVE-2022-21166 | None |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact |
CVE-2022-21127 MITRE NVD |
CVE Title: Intel: CVE-2022-21127 Special Register Buffer Data Sampling Update (SRBDS Update)
CVSS: None FAQ: Why is this Intel CVE included in the Security Update Guide? The vulnerability assigned to this CVE is in certain processor models offered by Intel. The mitigation for this vulnerability requires a firmware update, and a corresponding Windows updates enables the mitigation. This CVE is being documented in the Security Update Guide to announce that the latest builds of Windows enable the mitigation and are not vulnerable to the issue when paired with the firmware update. Please see the following for more information: Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Information Disclosure |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-21127 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 10 for 32-bit Systems | 5014710 (Security Update) | Important | Information Disclosure | 5013963 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 for x64-based Systems | 5014710 (Security Update) | Important | Information Disclosure | 5013963 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1607 for 32-bit Systems | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1607 for x64-based Systems | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1809 for 32-bit Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1809 for ARM64-based Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1809 for x64-based Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 20H2 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 20H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 20H2 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H1 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H1 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H1 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H2 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H2 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 11 for ARM64-based Systems | 5014697 (Security Update) | Important | Information Disclosure | 5013943 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 11 for x64-based Systems | 5014697 (Security Update) | Important | Information Disclosure | 5013943 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 7 for 32-bit Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 7 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 8.1 for 32-bit systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 8.1 for x64-based systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows RT 8.1 | 5014738 (Monthly Rollup) | Important | Information Disclosure | Base: N/A Temporal: N/A Vector: N/A |
Yes | |
Windows Server 2008 for 32-bit Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Information Disclosure | 5014017 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 (Server Core installation) | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Information Disclosure | 5014017 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 R2 | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 R2 (Server Core installation) | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2016 | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2016 (Server Core installation) | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2022 | 5014678 (Security Update) | Important | Information Disclosure | 5013944 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2022 (Server Core installation) | 5014678 (Security Update) | Important | Information Disclosure | 5013944 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server, version 20H2 (Server Core Installation) | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
CVE ID | Acknowledgements |
CVE-2022-21127 | None |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact |
CVE-2022-21123 MITRE NVD |
CVE Title: Intel: CVE-2022-21123 Shared Buffers Data Read (SBDR)
CVSS: None FAQ: Why is this Intel CVE included in the Security Update Guide? The vulnerability assigned to this CVE is in certain processor models offered by Intel. The mitigation for this vulnerability requires a firmware update, and a corresponding Windows updates enables the mitigation. This CVE is being documented in the Security Update Guide to announce that the latest builds of Windows enable the mitigation and are not vulnerable to the issue when paired with the firmware update. Please see the following for more information: Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Information Disclosure |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-21123 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 10 for 32-bit Systems | 5014710 (Security Update) | Important | Information Disclosure | 5013963 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 for x64-based Systems | 5014710 (Security Update) | Important | Information Disclosure | 5013963 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1607 for 32-bit Systems | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1607 for x64-based Systems | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1809 for 32-bit Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1809 for ARM64-based Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1809 for x64-based Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 20H2 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 20H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 20H2 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H1 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H1 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H1 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H2 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H2 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 11 for ARM64-based Systems | 5014697 (Security Update) | Important | Information Disclosure | 5013943 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 11 for x64-based Systems | 5014697 (Security Update) | Important | Information Disclosure | 5013943 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 7 for 32-bit Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 7 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 8.1 for 32-bit systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 8.1 for x64-based systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows RT 8.1 | 5014738 (Monthly Rollup) | Important | Information Disclosure | Base: N/A Temporal: N/A Vector: N/A |
Yes | |
Windows Server 2008 for 32-bit Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Information Disclosure | 5014017 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 (Server Core installation) | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Information Disclosure | 5014017 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 R2 | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 R2 (Server Core installation) | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2016 | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2016 (Server Core installation) | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2022 | 5014678 (Security Update) | Important | Information Disclosure | 5013944 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2022 (Server Core installation) | 5014678 (Security Update) | Important | Information Disclosure | 5013944 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server, version 20H2 (Server Core Installation) | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
CVE ID | Acknowledgements |
CVE-2022-21123 | None |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact |
CVE-2022-21125 MITRE NVD |
CVE Title: Intel: CVE-2022-21125 Shared Buffers Data Sampling (SBDS)
CVSS: None FAQ: Why is this Intel CVE included in the Security Update Guide? The vulnerability assigned to this CVE is in certain processor models offered by Intel. The mitigation for this vulnerability requires a firmware update, and a corresponding Windows updates enables the mitigation. This CVE is being documented in the Security Update Guide to announce that the latest builds of Windows enable the mitigation and are not vulnerable to the issue when paired with the firmware update. Please see the following for more information: Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Information Disclosure |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-21125 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 10 for 32-bit Systems | 5014710 (Security Update) | Important | Information Disclosure | 5013963 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 for x64-based Systems | 5014710 (Security Update) | Important | Information Disclosure | 5013963 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1607 for 32-bit Systems | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1607 for x64-based Systems | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1809 for 32-bit Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1809 for ARM64-based Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 1809 for x64-based Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 20H2 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 20H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 20H2 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H1 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H1 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H1 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H2 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 10 Version 21H2 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 11 for ARM64-based Systems | 5014697 (Security Update) | Important | Information Disclosure | 5013943 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 11 for x64-based Systems | 5014697 (Security Update) | Important | Information Disclosure | 5013943 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 7 for 32-bit Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 7 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 8.1 for 32-bit systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows 8.1 for x64-based systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows RT 8.1 | 5014738 (Monthly Rollup) | Important | Information Disclosure | Base: N/A Temporal: N/A Vector: N/A |
Yes | |
Windows Server 2008 for 32-bit Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Information Disclosure | 5014010 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Information Disclosure | 5014012 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Information Disclosure | 5014017 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 (Server Core installation) | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Information Disclosure | 5014017 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 R2 | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2012 R2 (Server Core installation) | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Information Disclosure | 5014011 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2016 | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2016 (Server Core installation) | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2022 | 5014678 (Security Update) | Important | Information Disclosure | 5013944 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server 2022 (Server Core installation) | 5014678 (Security Update) | Important | Information Disclosure | 5013944 | Base: N/A Temporal: N/A Vector: N/A |
Yes |
Windows Server, version 20H2 (Server Core Installation) | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: N/A Temporal: N/A Vector: N/A |
Yes |
CVE ID | Acknowledgements |
CVE-2022-21125 | None |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-29111 MITRE NVD |
CVE Title: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS: CVSS:3.1 7.8/6.8
FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Exploitation of the vulnerability requires that a user open a specially crafted file.
An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution? The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer. What is the difference between HEVC Video Extension and HEVC Video Extensions? HEVC Video Extension is available to consumers and HEVC Video Extensions is used by device OEMs. How can I check if the update is installed? If your device manufacturer preinstalled this app, package versions 2.0.51121.0 and later contain this update. If you purchased this app from the Microsoft Store, package versions 2.0.51122.0 and later contain this update. You can check the package version in PowerShell:
Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Remote Code Execution |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-29111 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
HEVC Video Extension | Update Information (Security Update) | Important | Remote Code Execution | None | Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Maybe |
HEVC Video Extensions | Update Information (Security Update) | Important | Remote Code Execution | None | Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Maybe |
CVE ID | Acknowledgements |
CVE-2022-29111 | Li Shuang and willJ of vulnerability research institute Ye Zhang (@co0py_Cat) with Baidu Security bugwhale |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
CVE-2022-29149 MITRE NVD |
CVE Title: Azure Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
CVSS: CVSS:3.1 7.8/7.0
FAQ: What are some of the services affected by this vulnerability? The following table lists some of the affected services, and the changes associated with the remedy for this vulnerability:
What is OMI? Open Management Infrastructure (OMI) is an open source project to further the development of a production quality implementation of the DMTF CIM/WBEM standards. The OMI CIMOM is also designed to be portable and highly modular. In order to attain its small footprint, it is coded in C, which also makes it a much more viable CIM Object Manager for embedded systems and other infrastructure components that have memory constraints for their management processor. OMI is also designed to be inherently portable. It builds and runs today on most UNIX® systems and Linux. In addition to OMI's small footprint, it also demonstrates very high performance. How do I protect myself from this vulnerability?
Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Elevation of Privilege |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-29149 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Azure Automation State Configuration, DSC Extension | Release Notes (Security Update) | Important | Elevation of Privilege | None | Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
Maybe |
Azure Automation Update Management | Release Notes (Security Update) | Important | Elevation of Privilege | None | Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
Maybe |
Azure Diagnostics (LAD) | Release Notes (Security Update) | Important | Elevation of Privilege | None | Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
Maybe |
Azure Open Management Infrastructure | Release Notes (Security Update) | Important | Elevation of Privilege | None | Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
Maybe |
Azure Security Center | Release Notes (Security Update) | Important | Elevation of Privilege | None | Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
Maybe |
Azure Sentinel | Release Notes (Security Update) | Important | Elevation of Privilege | None | Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
Maybe |
Azure Stack Hub | Release Notes (Security Update) | Important | Elevation of Privilege | None | Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
Maybe |
Container Monitoring Solution | Release Notes (Security Update) | Important | Elevation of Privilege | None | Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
Maybe |
Log Analytics Agent | Release Notes (Security Update) | Important | Elevation of Privilege | None | Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
Maybe |
System Center Operations Manager (SCOM) 2016 | Release Notes (Security Update) | Important | Elevation of Privilege | None | Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
Maybe |
System Center Operations Manager (SCOM) 2019 | Release Notes (Security Update) | Important | Elevation of Privilege | None | Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
Maybe |
System Center Operations Manager (SCOM) 2022 | Release Notes (Security Update) | Important | Elevation of Privilege | None | Base: 7.8 Temporal: 7.0 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
Maybe |
CVE ID | Acknowledgements |
CVE-2022-29149 | None |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-22018 MITRE NVD |
CVE Title: HEVC Video Extensions Remote Code Execution Vulnerability
CVSS: CVSS:3.1 7.8/6.8
FAQ: According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution? The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer. What is the difference between HEVC Video Extension and HEVC Video Extensions? HEVC Video Extension is available to consumers and HEVC Video Extensions is used by device OEMs. Is Windows vulnerable in the default configuration? No. Only customers who have installed the optional HEVC or "HEVC from Device Manufacturer" media codecs from Microsoft Store may be vulnerable. How do I get the updated Windows Media Codec? Affected customers will be automatically updated by Microsoft Store. Customers do not need to take any action to receive the update. Alternatively, customers who want to receive the update immediately can check for updates with the Microsoft Store App; more information on this process can be found here. Why are these security updates offered to affected clients via the Microsoft Store and not Windows Update? These updates are for optional apps/components that are offered to customers as a download via the Microsoft Store. Updates for optional store apps/components are provided via the Microsoft Store. My server is in a disconnected environment, is it vulnerable? HEVC is not available for offline distribution and not supported on Windows Server. Users should not have it installed in these environments. Enterprise customers using Store for Business will receive the update in the same manner as consumer Store. Why are these updates being offered outside of Update Tuesday? Servicing for store apps/components does not follow the monthly “Update Tuesday” cadence, but are offered whenever necessary. Are these updates for Microsoft store apps/components offered automatically when an affected component is on the system? Yes. However, it is possible to turn off automatic updating for store apps. In that scenario, these updates would not be installed automatically. How can I check from PowerShell if the update is installed? The following command will display the version of the installed package:
How can I check if the update is installed? If your device manufacturer preinstalled this app, package versions 2.0.51121.0 and later contain this update. If you purchased this app from the Microsoft Store, package versions 2.0.51122.0 and later contain this update. You can check the package version in PowerShell:
Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Remote Code Execution |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-22018 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
HEVC Video Extension | Update Information (Security Update) | Important | Remote Code Execution | None | Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Maybe |
HEVC Video Extensions | Update Information (Security Update) | Important | Remote Code Execution | None | Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Maybe |
CVE ID | Acknowledgements |
CVE-2022-22018 | Dhanesh Kizhakkinan with Mandiant PeaceMaker |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||||||||
CVE-2022-22021 MITRE NVD |
CVE Title: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVSS: CVSS:3.1 8.3/7.2
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to win a race condition. According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability? This vulnerability could lead to a browser sandbox escape. Why is the severity for this CVE rated as Moderate, but the CVSS score is higher than normal? Per our severity guidelines, the amount of user interaction or preconditions required to allow this sort of exploitation downgraded the severity, specifically it says, "If a bug requires more than a click, a key press, or several preconditions, the severity will be downgraded". The CVSS scoring system doesn't allow for this type of nuance. How could an attacker exploit this vulnerability via the Network? An attacker could host a specially crafted website designed to exploit the vulnerability through Microsoft Edge and then convince a user to view the website. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action, typically by an enticement in an email or instant message, or by getting the user to open an attachment sent through email. What is the version information for this release?
Mitigations: None Workarounds: None Revision: 1.0    2022-06-09T07:00:00     Information published. |
Moderate | Remote Code Execution |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-22021 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Microsoft Edge (Chromium-based) | Release Notes (Security Update) | Moderate | Remote Code Execution | None | Base: 8.3 Temporal: 7.2 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C |
No |
CVE ID | Acknowledgements |
CVE-2022-22021 | David Erceg |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-30131 MITRE NVD |
CVE Title: Windows Container Isolation FS Filter Driver Elevation of Privilege Vulnerability
CVSS: CVSS:3.1 7.8/6.8
FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Elevation of Privilege |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-30131 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows Server 2016 | 5014702 (Security Update) | Important | Elevation of Privilege | 5013952 | Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 (Server Core installation) | 5014702 (Security Update) | Important | Elevation of Privilege | 5013952 | Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 | 5014678 (Security Update) | Important | Elevation of Privilege | 5013944 | Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 (Server Core installation) | 5014678 (Security Update) | Important | Elevation of Privilege | 5013944 | Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server, version 20H2 (Server Core Installation) | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
CVE ID | Acknowledgements |
CVE-2022-30131 | k0shl with Kunlun Lab |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-30132 MITRE NVD |
CVE Title: Windows Container Manager Service Elevation of Privilege Vulnerability
CVSS: CVSS:3.1 7.8/6.8
FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Elevation of Privilege |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-30132 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 10 Version 1809 for 32-bit Systems | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for ARM64-based Systems | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for x64-based Systems | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for 32-bit Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for x64-based Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for 32-bit Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for ARM64-based Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for x64-based Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for 32-bit Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for x64-based Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for ARM64-based Systems | 5014697 (Security Update) | Important | Elevation of Privilege | 5013943 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for x64-based Systems | 5014697 (Security Update) | Important | Elevation of Privilege | 5013943 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 | 5014678 (Security Update) | Important | Elevation of Privilege | 5013944 | Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 (Server Core installation) | 5014678 (Security Update) | Important | Elevation of Privilege | 5013944 | Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 Azure Edition Core Hotpatch | 5014677 (Azure Hotpatch) | Important | Elevation of Privilege | None | Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server, version 20H2 (Server Core Installation) | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.8 Temporal: 6.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
CVE ID | Acknowledgements |
CVE-2022-30132 | k0shl with Kunlun Lab |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact |
ADV220002 MITRE NVD |
CVE Title: Microsoft Guidance on Intel Processor MMIO Stale Data Vulnerabilities
CVSS: None FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Unknown | Unknown |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
ADV220002 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
CVE ID | Acknowledgements |
ADV220002 | None |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-30135 MITRE NVD |
CVE Title: Windows Media Center Elevation of Privilege Vulnerability
CVSS: CVSS:3.1 7.8/6.9
FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Elevation of Privilege |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-30135 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 7 for 32-bit Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Elevation of Privilege | 5014012 |
Base: 7.8 Temporal: 6.9 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C |
Yes |
Windows 7 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Elevation of Privilege | 5014012 |
Base: 7.8 Temporal: 6.9 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C |
Yes |
Windows 8.1 for 32-bit systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Elevation of Privilege | 5014011 |
Base: 7.8 Temporal: 6.9 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C |
Yes |
Windows 8.1 for x64-based systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Elevation of Privilege | 5014011 |
Base: 7.8 Temporal: 6.9 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C |
Yes |
Windows RT 8.1 | 5014738 (Monthly Rollup) | Important | Elevation of Privilege | Base: 7.8 Temporal: 6.9 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C |
Yes | |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Elevation of Privilege | 5014012 |
Base: 7.8 Temporal: 6.9 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Elevation of Privilege | 5014012 |
Base: 7.8 Temporal: 6.9 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C |
Yes |
Windows Server 2012 | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Elevation of Privilege | 5014017 |
Base: 7.8 Temporal: 6.9 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C |
Yes |
Windows Server 2012 (Server Core installation) | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Elevation of Privilege | 5014017 |
Base: 7.8 Temporal: 6.9 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C |
Yes |
Windows Server 2012 R2 | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Elevation of Privilege | 5014011 |
Base: 7.8 Temporal: 6.9 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C |
Yes |
Windows Server 2012 R2 (Server Core installation) | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Elevation of Privilege | 5014011 |
Base: 7.8 Temporal: 6.9 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:T/RC:C |
Yes |
CVE ID | Acknowledgements |
CVE-2022-30135 | JIWO Technology Co., Ltd |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-30136 MITRE NVD |
CVE Title: Windows Network File System Remote Code Execution Vulnerability
CVSS: CVSS:3.1 9.8/8.5
FAQ: How could an attacker exploit this vulnerability? This vulnerability could be exploited over the network by making an unauthenticated, specially crafted call to a Network File System (NFS) service to trigger a Remote Code Execution (RCE). Mitigations: Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Critical | Remote Code Execution |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation More Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-30136 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows Server 2012 | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Critical | Remote Code Execution | 5014017 |
Base: 9.8 Temporal: 8.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 (Server Core installation) | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Critical | Remote Code Execution | 5014017 |
Base: 9.8 Temporal: 8.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 R2 | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Critical | Remote Code Execution | 5014011 |
Base: 9.8 Temporal: 8.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 R2 (Server Core installation) | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Critical | Remote Code Execution | 5014011 |
Base: 9.8 Temporal: 8.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 | 5014702 (Security Update) | Critical | Remote Code Execution | 5013952 | Base: 9.8 Temporal: 8.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 (Server Core installation) | 5014702 (Security Update) | Critical | Remote Code Execution | 5013952 | Base: 9.8 Temporal: 8.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Critical | Remote Code Execution | 5013941 |
Base: 9.8 Temporal: 8.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Critical | Remote Code Execution | 5013941 |
Base: 9.8 Temporal: 8.5 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
CVE ID | Acknowledgements |
CVE-2022-30136 | Yuki Chen with Cyber KunLun |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-30137 MITRE NVD |
CVE Title: Azure Service Fabric Container Elevation of Privilege Vulnerability
CVSS: CVSS:3.1 6.7/6.0
FAQ: According to the CVSS metric, Privileges Required is High (PR:H). What would lead to a successful attack? In order for the successful attack to be initiated, the attacker would need to have read/write access to the cluster and the ability to host a hostile code without any isolation. What is being fixed in CVE-2022-30137? Azure Service Fabric team is releasing a patch to further strengthen the security in the Linux cluster by adapting the principle of path to least privilege. Windows cluster are NOT impacted by this vulnerability. How to protect yourself? Customers without automatic updates enabled should upgrade their Linux clusters to the most recent Service Fabric release. Customers whose Linux clusters are automatically updated do not need to take further action. We have also updated our public security guidance to include details regarding the implications of hosting untrusted code or having one’s containers compromised. Please see the information here: Hosting untrusted applications in a Service Fabric cluster Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Elevation of Privilege |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-30137 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Azure Service Fabric | Important | Elevation of Privilege | None | Base: 6.7 Temporal: 6.0 Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C |
Unknown |
CVE ID | Acknowledgements |
CVE-2022-30137 | Aviv Sasson with Palo Alto Networks |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-30140 MITRE NVD |
CVE Title: Windows iSCSI Discovery Service Remote Code Execution Vulnerability
CVSS: CVSS:3.1 7.1/6.2
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment of the targeted component. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Successful exploitation of this vulnerability requires a user to place a call to trigger the vulnerability. Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Remote Code Execution |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-30140 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 10 for 32-bit Systems | 5014710 (Security Update) | Important | Remote Code Execution | 5013963 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 for x64-based Systems | 5014710 (Security Update) | Important | Remote Code Execution | 5013963 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for 32-bit Systems | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for x64-based Systems | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for 32-bit Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for ARM64-based Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for x64-based Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for ARM64-based Systems | 5014697 (Security Update) | Important | Remote Code Execution | 5013943 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for x64-based Systems | 5014697 (Security Update) | Important | Remote Code Execution | 5013943 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 7 for 32-bit Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 7 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 8.1 for 32-bit systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 8.1 for x64-based systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows RT 8.1 | 5014738 (Monthly Rollup) | Important | Remote Code Execution | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes | |
Windows Server 2008 for 32-bit Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Remote Code Execution | 5014017 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 (Server Core installation) | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Remote Code Execution | 5014017 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 R2 | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 R2 (Server Core installation) | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 (Server Core installation) | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 | 5014678 (Security Update) | Important | Remote Code Execution | 5013944 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 (Server Core installation) | 5014678 (Security Update) | Important | Remote Code Execution | 5013944 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 Azure Edition Core Hotpatch | 5014677 (Azure Hotpatch) | Important | Remote Code Execution | None | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server, version 20H2 (Server Core Installation) | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
CVE ID | Acknowledgements |
CVE-2022-30140 | Andrew Ruddick with Microsoft Security Response Center George Hughey with Microsoft Security Response Center |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-30141 MITRE NVD |
CVE Title: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS: CVSS:3.1 8.1/7.1
FAQ: Are there any special conditions necessary for this vulnerability to be exploitable? Yes. This vulnerability is only exploitable if the MaxReceiveBuffer LDAP policy is set to a value higher than the default value. Systems with the default value of this policy would not be vulnerable. For more information, please see LDAP policies. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability. How could an attacker exploit this vulnerability? An unauthenticated attacker could send a specially crafted request to a vulnerable server. Successful exploitation could result in the attacker's code running in the context of the SYSTEM account. Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Remote Code Execution |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-30141 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 10 for 32-bit Systems | 5014710 (Security Update) | Important | Remote Code Execution | 5013963 | Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 for x64-based Systems | 5014710 (Security Update) | Important | Remote Code Execution | 5013963 | Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for 32-bit Systems | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for x64-based Systems | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for 32-bit Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for ARM64-based Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for x64-based Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for ARM64-based Systems | 5014697 (Security Update) | Important | Remote Code Execution | 5013943 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for x64-based Systems | 5014697 (Security Update) | Important | Remote Code Execution | 5013943 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 7 for 32-bit Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 7 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 8.1 for 32-bit systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 8.1 for x64-based systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows RT 8.1 | 5014738 (Monthly Rollup) | Important | Remote Code Execution | Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes | |
Windows Server 2008 for 32-bit Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Remote Code Execution | 5014017 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 (Server Core installation) | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Remote Code Execution | 5014017 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 R2 | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 R2 (Server Core installation) | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 (Server Core installation) | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 | 5014678 (Security Update) | Important | Remote Code Execution | 5013944 | Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 (Server Core installation) | 5014678 (Security Update) | Important | Remote Code Execution | 5013944 | Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 Azure Edition Core Hotpatch | 5014677 (Azure Hotpatch) | Important | Remote Code Execution | None | Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server, version 20H2 (Server Core Installation) | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 8.1 Temporal: 7.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
CVE ID | Acknowledgements |
CVE-2022-30141 | Yuki Chen with Cyber KunLun |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-30142 MITRE NVD |
CVE Title: Windows File History Remote Code Execution Vulnerability
CVSS: CVSS:3.1 7.1/6.2
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? This vulnerability could be triggered when a windows client connects to a malicious remote share. Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Remote Code Execution |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-30142 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 10 for 32-bit Systems | 5014710 (Security Update) | Important | Remote Code Execution | 5013963 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 for x64-based Systems | 5014710 (Security Update) | Important | Remote Code Execution | 5013963 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for 32-bit Systems | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for x64-based Systems | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for 32-bit Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for ARM64-based Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for x64-based Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for ARM64-based Systems | 5014697 (Security Update) | Important | Remote Code Execution | 5013943 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for x64-based Systems | 5014697 (Security Update) | Important | Remote Code Execution | 5013943 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 7 for 32-bit Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 7 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 8.1 for 32-bit systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 8.1 for x64-based systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows RT 8.1 | 5014738 (Monthly Rollup) | Important | Remote Code Execution | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes | |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Remote Code Execution | 5014017 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 (Server Core installation) | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Remote Code Execution | 5014017 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 R2 | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 R2 (Server Core installation) | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 (Server Core installation) | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 | 5014678 (Security Update) | Important | Remote Code Execution | 5013944 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 (Server Core installation) | 5014678 (Security Update) | Important | Remote Code Execution | 5013944 | Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server, version 20H2 (Server Core Installation) | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.1 Temporal: 6.2 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
CVE ID | Acknowledgements |
CVE-2022-30142 | Yuki Chen with Cyber KunLun |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-30143 MITRE NVD |
CVE Title: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS: CVSS:3.1 7.5/6.5
FAQ: Are there any special conditions necessary for this vulnerability to be exploitable? Yes. This vulnerability is only exploitable if the MaxReceiveBuffer LDAP policy is set to a value higher than the default value. Systems with the default value of this policy would not be vulnerable. For more information, please see LDAP policies. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability. According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution? An authenticated victim who is connected to the network must be tricked or persuaded to connect to a malicious LDAP server using their LDAP client application. After the connection is made, the server can send specially crafted replies to the client that exploit the vulnerability and permit execution of arbitrary code within the context of the user's LDAP client application. Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Remote Code Execution |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-30143 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 10 for 32-bit Systems | 5014710 (Security Update) | Important | Remote Code Execution | 5013963 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 for x64-based Systems | 5014710 (Security Update) | Important | Remote Code Execution | 5013963 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for 32-bit Systems | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for x64-based Systems | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for 32-bit Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for ARM64-based Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for x64-based Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for ARM64-based Systems | 5014697 (Security Update) | Important | Remote Code Execution | 5013943 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for x64-based Systems | 5014697 (Security Update) | Important | Remote Code Execution | 5013943 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 7 for 32-bit Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 7 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 8.1 for 32-bit systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 8.1 for x64-based systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows RT 8.1 | 5014738 (Monthly Rollup) | Important | Remote Code Execution | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes | |
Windows Server 2008 for 32-bit Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Remote Code Execution | 5014017 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 (Server Core installation) | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Remote Code Execution | 5014017 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 R2 | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 R2 (Server Core installation) | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 (Server Core installation) | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 | 5014678 (Security Update) | Important | Remote Code Execution | 5013944 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 (Server Core installation) | 5014678 (Security Update) | Important | Remote Code Execution | 5013944 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 Azure Edition Core Hotpatch | 5014677 (Azure Hotpatch) | Important | Remote Code Execution | None | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server, version 20H2 (Server Core Installation) | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
CVE ID | Acknowledgements |
CVE-2022-30143 | Yuki Chen with Cyber KunLun |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-30145 MITRE NVD |
CVE Title: Windows Encrypting File System (EFS) Remote Code Execution Vulnerability
CVSS: CVSS:3.1 7.5/6.5
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability. Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Remote Code Execution |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-30145 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 10 Version 1607 for 32-bit Systems | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for x64-based Systems | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for 32-bit Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for ARM64-based Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for x64-based Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for ARM64-based Systems | 5014697 (Security Update) | Important | Remote Code Execution | 5013943 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for x64-based Systems | 5014697 (Security Update) | Important | Remote Code Execution | 5013943 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 (Server Core installation) | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 | 5014678 (Security Update) | Important | Remote Code Execution | 5013944 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 (Server Core installation) | 5014678 (Security Update) | Important | Remote Code Execution | 5013944 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 Azure Edition Core Hotpatch | 5014677 (Azure Hotpatch) | Important | Remote Code Execution | None | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server, version 20H2 (Server Core Installation) | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
CVE ID | Acknowledgements |
CVE-2022-30145 | Azure Yang with Kunlun Lab |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-30148 MITRE NVD |
CVE Title: Windows Desired State Configuration (DSC) Information Disclosure Vulnerability
CVSS: CVSS:3.1 5.5/4.8
FAQ: What type of information could be disclosed by this vulnerability? An attacker that successfully exploited this vulnerability could recover plaintext passwords and usernames from log files. Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Information Disclosure |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-30148 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 10 Version 1607 for 32-bit Systems | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for x64-based Systems | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for 32-bit Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for ARM64-based Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for x64-based Systems | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for 32-bit Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for x64-based Systems | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 11 for ARM64-based Systems | 5014697 (Security Update) | Important | Information Disclosure | 5013943 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows 11 for x64-based Systems | 5014697 (Security Update) | Important | Information Disclosure | 5013943 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 (Server Core installation) | 5014702 (Security Update) | Important | Information Disclosure | 5013952 | Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Important | Information Disclosure | 5013941 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 | 5014678 (Security Update) | Important | Information Disclosure | 5013944 | Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 (Server Core installation) | 5014678 (Security Update) | Important | Information Disclosure | 5013944 | Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
Windows Server, version 20H2 (Server Core Installation) | 5014699 (Security Update) | Important | Information Disclosure | 5013942 |
Base: 5.5 Temporal: 4.8 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C |
Yes |
CVE ID | Acknowledgements |
CVE-2022-30148 | None |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-30149 MITRE NVD |
CVE Title: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVSS: CVSS:3.1 7.5/6.5
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability. According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution? An authenticated victim who is connected to the network must be tricked or persuaded to connect to a malicious LDAP server using their LDAP client application. After the connection is made, the server can send specially crafted replies to the client that exploit the vulnerability and permit execution of arbitrary code within the context of the user's LDAP client application. Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Remote Code Execution |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-30149 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 10 for 32-bit Systems | 5014710 (Security Update) | Important | Remote Code Execution | 5013963 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 for x64-based Systems | 5014710 (Security Update) | Important | Remote Code Execution | 5013963 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for 32-bit Systems | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for x64-based Systems | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for 32-bit Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for ARM64-based Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for x64-based Systems | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for 32-bit Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for x64-based Systems | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for ARM64-based Systems | 5014697 (Security Update) | Important | Remote Code Execution | 5013943 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for x64-based Systems | 5014697 (Security Update) | Important | Remote Code Execution | 5013943 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 7 for 32-bit Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 7 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 8.1 for 32-bit systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 8.1 for x64-based systems | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows RT 8.1 | 5014738 (Monthly Rollup) | Important | Remote Code Execution | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes | |
Windows Server 2008 for 32-bit Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) | 5014752 (Monthly Rollup) 5014743 (Security Only) |
Important | Remote Code Execution | 5014010 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) | 5014748 (Monthly Rollup) 5014742 (Security Only) |
Important | Remote Code Execution | 5014012 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Remote Code Execution | 5014017 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 (Server Core installation) | 5014747 (Monthly Rollup) 5014741 (Security Only) |
Important | Remote Code Execution | 5014017 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 R2 | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2012 R2 (Server Core installation) | 5014738 (Monthly Rollup) 5014746 (Security Only) |
Important | Remote Code Execution | 5014011 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 (Server Core installation) | 5014702 (Security Update) | Important | Remote Code Execution | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Important | Remote Code Execution | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 | 5014678 (Security Update) | Important | Remote Code Execution | 5013944 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 (Server Core installation) | 5014678 (Security Update) | Important | Remote Code Execution | 5013944 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 Azure Edition Core Hotpatch | 5014677 (Azure Hotpatch) | Important | Remote Code Execution | None | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server, version 20H2 (Server Core Installation) | 5014699 (Security Update) | Important | Remote Code Execution | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
CVE ID | Acknowledgements |
CVE-2022-30149 | Yuki Chen with Cyber KunLun |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-30150 MITRE NVD |
CVE Title: Windows Defender Remote Credential Guard Elevation of Privilege Vulnerability
CVSS: CVSS:3.1 7.5/6.5
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment of the targeted component. Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Elevation of Privilege |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-30150 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 10 Version 1607 for 32-bit Systems | 5014702 (Security Update) | Important | Elevation of Privilege | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for x64-based Systems | 5014702 (Security Update) | Important | Elevation of Privilege | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for 32-bit Systems | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for ARM64-based Systems | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for x64-based Systems | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for 32-bit Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for x64-based Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for 32-bit Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for ARM64-based Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 for x64-based Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for 32-bit Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H2 for x64-based Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for ARM64-based Systems | 5014697 (Security Update) | Important | Elevation of Privilege | 5013943 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 11 for x64-based Systems | 5014697 (Security Update) | Important | Elevation of Privilege | 5013943 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 | 5014702 (Security Update) | Important | Elevation of Privilege | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2016 (Server Core installation) | 5014702 (Security Update) | Important | Elevation of Privilege | 5013952 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2019 (Server Core installation) | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 | 5014678 (Security Update) | Important | Elevation of Privilege | 5013944 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 (Server Core installation) | 5014678 (Security Update) | Important | Elevation of Privilege | 5013944 | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server 2022 Azure Edition Core Hotpatch | 5014677 (Azure Hotpatch) | Important | Elevation of Privilege | None | Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows Server, version 20H2 (Server Core Installation) | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.5 Temporal: 6.5 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
CVE ID | Acknowledgements |
CVE-2022-30150 | James Forshaw with Google Project Zero |
CVE ID | Vulnerability Description | Maximum Severity Rating | Vulnerability Impact | ||||||||||||||||||||||||||||||||||||
CVE-2022-30151 MITRE NVD |
CVE Title: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVSS: CVSS:3.1 7.0/6.1
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to win a race condition. Mitigations: None Workarounds: None Revision: 1.0    2022-06-14T07:00:00     Information published. |
Important | Elevation of Privilege |
The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.
Exploitability Assessment | Publicly Disclosed | Exploited |
Exploitation Less Likely | No | No |
The following tables list the affected software details for the vulnerability.
CVE-2022-30151 | ||||||
Product | KB Article | Severity | Impact | Supercedence | CVSS Score Set | Restart Required |
Windows 10 for 32-bit Systems | 5014710 (Security Update) | Important | Elevation of Privilege | 5013963 | Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 for x64-based Systems | 5014710 (Security Update) | Important | Elevation of Privilege | 5013963 | Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for 32-bit Systems | 5014702 (Security Update) | Important | Elevation of Privilege | 5013952 | Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1607 for x64-based Systems | 5014702 (Security Update) | Important | Elevation of Privilege | 5013952 | Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for 32-bit Systems | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for ARM64-based Systems | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 1809 for x64-based Systems | 5014692 (Security Update) | Important | Elevation of Privilege | 5013941 |
Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for 32-bit Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for ARM64-based Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 20H2 for x64-based Systems | 5014699 (Security Update) | Important | Elevation of Privilege | 5013942 |
Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
Yes |
Windows 10 Version 21H1 fo |