Microsoft CVE Summary

This report contains detail for the following vulnerabilities:

Tag	CVE ID	CVE Title
Azure DevOps	CVE-2020-1325	Azure DevOps Server and Team Foundation Services Spoofing Vulnerability
Azure Sphere	CVE-2020-16985	Azure Sphere Information Disclosure Vulnerability
Azure Sphere	CVE-2020-16986	Azure Sphere Denial of Service Vulnerability
Azure Sphere	CVE-2020-16987	Azure Sphere Unsigned Code Execution Vulnerability
Azure Sphere	CVE-2020-16984	Azure Sphere Unsigned Code Execution Vulnerability
Azure Sphere	CVE-2020-16981	Azure Sphere Elevation of Privilege Vulnerability
Azure Sphere	CVE-2020-16982	Azure Sphere Unsigned Code Execution Vulnerability
Azure Sphere	CVE-2020-16983	Azure Sphere Tampering Vulnerability
Azure Sphere	CVE-2020-16988	Azure Sphere Elevation of Privilege Vulnerability
Azure Sphere	CVE-2020-16993	Azure Sphere Elevation of Privilege Vulnerability
Azure Sphere	CVE-2020-16994	Azure Sphere Unsigned Code Execution Vulnerability
Azure Sphere	CVE-2020-16970	Azure Sphere Unsigned Code Execution Vulnerability
Azure Sphere	CVE-2020-16992	Azure Sphere Elevation of Privilege Vulnerability
Azure Sphere	CVE-2020-16989	Azure Sphere Elevation of Privilege Vulnerability
Azure Sphere	CVE-2020-16990	Azure Sphere Information Disclosure Vulnerability
Azure Sphere	CVE-2020-16991	Azure Sphere Unsigned Code Execution Vulnerability
Common Log File System Driver	CVE-2020-17088	Windows Common Log File System Driver Elevation of Privilege Vulnerability
Microsoft Browsers	CVE-2020-17058	Microsoft Browser Memory Corruption Vulnerability
Microsoft Dynamics	CVE-2020-17005	Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics	CVE-2020-17018	Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics	CVE-2020-17021	Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Dynamics	CVE-2020-17006	Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
Microsoft Exchange Server	CVE-2020-17083	Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server	CVE-2020-17085	Microsoft Exchange Server Denial of Service Vulnerability
Microsoft Exchange Server	CVE-2020-17084	Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Graphics Component	CVE-2020-16998	DirectX Elevation of Privilege Vulnerability
Microsoft Graphics Component	CVE-2020-17029	Windows Canonical Display Driver Information Disclosure Vulnerability
Microsoft Graphics Component	CVE-2020-17004	Windows Graphics Component Information Disclosure Vulnerability
Microsoft Graphics Component	CVE-2020-17038	Win32k Elevation of Privilege Vulnerability
Microsoft Graphics Component	CVE-2020-17068	Windows GDI+ Remote Code Execution Vulnerability
Microsoft Office	CVE-2020-17065	Microsoft Excel Remote Code Execution Vulnerability
Microsoft Office	CVE-2020-17064	Microsoft Excel Remote Code Execution Vulnerability
Microsoft Office	CVE-2020-17066	Microsoft Excel Remote Code Execution Vulnerability
Microsoft Office	CVE-2020-17019	Microsoft Excel Remote Code Execution Vulnerability
Microsoft Office	CVE-2020-17067	Microsoft Excel Security Feature Bypass Vulnerability
Microsoft Office	CVE-2020-17062	Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
Microsoft Office	CVE-2020-17063	Microsoft Office Online Spoofing Vulnerability
Microsoft Office	CVE-2020-17020	Microsoft Word Security Feature Bypass Vulnerability
Microsoft Office SharePoint	CVE-2020-17016	Microsoft SharePoint Spoofing Vulnerability
Microsoft Office SharePoint	CVE-2020-16979	Microsoft SharePoint Information Disclosure Vulnerability
Microsoft Office SharePoint	CVE-2020-17015	Microsoft SharePoint Spoofing Vulnerability
Microsoft Office SharePoint	CVE-2020-17017	Microsoft SharePoint Information Disclosure Vulnerability
Microsoft Office SharePoint	CVE-2020-17061	Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft Office SharePoint	CVE-2020-17060	Microsoft SharePoint Spoofing Vulnerability
Microsoft Scripting Engine	CVE-2020-17048	Chakra Scripting Engine Memory Corruption Vulnerability
Microsoft Scripting Engine	CVE-2020-17053	Internet Explorer Memory Corruption Vulnerability
Microsoft Scripting Engine	CVE-2020-17052	Scripting Engine Memory Corruption Vulnerability
Microsoft Scripting Engine	CVE-2020-17054	Chakra Scripting Engine Memory Corruption Vulnerability
Microsoft Teams	CVE-2020-17091	Microsoft Teams Remote Code Execution Vulnerability
Microsoft Windows	CVE-2020-17032	Windows Remote Access Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17033	Windows Remote Access Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17026	Windows Remote Access Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17031	Windows Remote Access Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17027	Windows Remote Access Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17030	Windows MSCTF Server Information Disclosure Vulnerability
Microsoft Windows	CVE-2020-17028	Windows Remote Access Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17044	Windows Remote Access Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17045	Windows KernelStream Information Disclosure Vulnerability
Microsoft Windows	CVE-2020-17046	Windows Error Reporting Denial of Service Vulnerability
Microsoft Windows	CVE-2020-17043	Windows Remote Access Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17042	Windows Print Spooler Remote Code Execution Vulnerability
Microsoft Windows	CVE-2020-17041	Windows Print Configuration Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17034	Windows Remote Access Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17049	Kerberos Security Feature Bypass Vulnerability
Microsoft Windows	CVE-2020-17051	Windows Network File System Remote Code Execution Vulnerability
Microsoft Windows	CVE-2020-17040	Windows Hyper-V Security Feature Bypass Vulnerability
Microsoft Windows	CVE-2020-17047	Windows Network File System Denial of Service Vulnerability
Microsoft Windows	CVE-2020-17036	Windows Function Discovery SSDP Provider Information Disclosure Vulnerability
Microsoft Windows	CVE-2020-17000	Remote Desktop Protocol Client Information Disclosure Vulnerability
Microsoft Windows	CVE-2020-1599	Windows Spoofing Vulnerability
Microsoft Windows	CVE-2020-16997	Remote Desktop Protocol Server Information Disclosure Vulnerability
Microsoft Windows	CVE-2020-17001	Windows Print Spooler Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17057	Windows Win32k Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17056	Windows Network File System Information Disclosure Vulnerability
Microsoft Windows	CVE-2020-17055	Windows Remote Access Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17010	Win32k Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17007	Windows Error Reporting Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17014	Windows Print Spooler Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17025	Windows Remote Access Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17024	Windows Client Side Rendering Print Provider Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17013	Win32k Information Disclosure Vulnerability
Microsoft Windows	CVE-2020-17011	Windows Port Class Library Elevation of Privilege Vulnerability
Microsoft Windows	CVE-2020-17012	Windows Bind Filter Driver Elevation of Privilege Vulnerability
Microsoft Windows Codecs Library	CVE-2020-17106	HEVC Video Extensions Remote Code Execution Vulnerability
Microsoft Windows Codecs Library	CVE-2020-17101	HEIF Image Extensions Remote Code Execution Vulnerability
Microsoft Windows Codecs Library	CVE-2020-17105	AV1 Video Extension Remote Code Execution Vulnerability
Microsoft Windows Codecs Library	CVE-2020-17102	WebP Image Extensions Information Disclosure Vulnerability
Microsoft Windows Codecs Library	CVE-2020-17082	Raw Image Extension Remote Code Execution Vulnerability
Microsoft Windows Codecs Library	CVE-2020-17086	Raw Image Extension Remote Code Execution Vulnerability
Microsoft Windows Codecs Library	CVE-2020-17081	Microsoft Raw Image Extension Information Disclosure Vulnerability
Microsoft Windows Codecs Library	CVE-2020-17079	Raw Image Extension Remote Code Execution Vulnerability
Microsoft Windows Codecs Library	CVE-2020-17078	Raw Image Extension Remote Code Execution Vulnerability
Microsoft Windows Codecs Library	CVE-2020-17107	HEVC Video Extensions Remote Code Execution Vulnerability
Microsoft Windows Codecs Library	CVE-2020-17110	HEVC Video Extensions Remote Code Execution Vulnerability
Microsoft Windows Codecs Library	CVE-2020-17113	Windows Camera Codec Information Disclosure Vulnerability
Microsoft Windows Codecs Library	CVE-2020-17108	HEVC Video Extensions Remote Code Execution Vulnerability
Microsoft Windows Codecs Library	CVE-2020-17109	HEVC Video Extensions Remote Code Execution Vulnerability
Visual Studio	CVE-2020-17104	Visual Studio Code JSHint Extension Remote Code Execution Vulnerability
Visual Studio	CVE-2020-17100	Visual Studio Tampering Vulnerability
Windows Defender	CVE-2020-17090	Microsoft Defender for Endpoint Security Feature Bypass Vulnerability
Windows Kernel	CVE-2020-17035	Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel	CVE-2020-17087	Windows Kernel Local Elevation of Privilege Vulnerability
Windows NDIS	CVE-2020-17069	Windows NDIS Information Disclosure Vulnerability
Windows Update Stack	CVE-2020-17074	Windows Update Orchestrator Service Elevation of Privilege Vulnerability
Windows Update Stack	CVE-2020-17073	Windows Update Orchestrator Service Elevation of Privilege Vulnerability
Windows Update Stack	CVE-2020-17071	Windows Delivery Optimization Information Disclosure Vulnerability
Windows Update Stack	CVE-2020-17075	Windows USO Core Worker Elevation of Privilege Vulnerability
Windows Update Stack	CVE-2020-17070	Windows Update Medic Service Elevation of Privilege Vulnerability
Windows Update Stack	CVE-2020-17077	Windows Update Stack Elevation of Privilege Vulnerability
Windows Update Stack	CVE-2020-17076	Windows Update Orchestrator Service Elevation of Privilege Vulnerability
Windows WalletService	CVE-2020-16999	Windows WalletService Information Disclosure Vulnerability
Windows WalletService	CVE-2020-17037	Windows WalletService Elevation of Privilege Vulnerability

CVE-2020-16970 - Azure Sphere Unsigned Code Execution Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-16970 MITRE NVD	CVE Title: Azure Sphere Unsigned Code Execution Vulnerability CVSS: CVSS:3.0 8.1/7.1 Base score metrics Attack Vector Local Attack Complexity High Privileges Required None User Interaction None Scope Changed Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: Azure Sphere is running on IoT devices in my environment. How do I know if any of those devices are affected by this vulnerability? An IoT device that is running Azure Sphere and is connected to a network is automatically updated every day. This vulnerability has already been addressed so the devices are protected from this vulnerability. What version of Azure Sphere has the update that protects from this vulnerability? All versions of Azure Sphere that are 20.07 and higher are protected from this vulnerability. How do I ensure my Azure Sphere device has the update? If your device is new or has not been connected to the internet for a while, connect the device to a secure, private local network with internet access and allow the device to automatically update itself. If the device is already online, verify that the operating system version 20.07 has been installed using the Azure Sphere CLI command: azsphere device show-os-version If the device is connected to the internet and does not yet have the latest update, check the update status with the following Azure Sphere CLI command: azsphere device show-deployment-status If I am a manufacturer or OEM, what action should I take? This vulnerability was fixed in version 20.07. Ensure that all devices being shipped or deployed include this version or newer. This is the first time that a CVE has been issued against Azure Sphere. Why is that? The Azure Sphere team in coordination with the MSRC bounty team just completed the Azure Sphere Security Research Challenge. We appreciate all of the hard work that the researchers did to help, and will be opening up several CVEs this month and over the next few to record and reflect this work. Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-16970
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Azure Sphere	Release Notes (Security Update)	Important	Remote Code Execution	None	Base: 8.1 Temporal: 7.1 Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-16970	Lilith [^_^], Claudio Bozzato and Dave McDaniel of Cisco Talos

CVE-2020-16979 - Microsoft SharePoint Information Disclosure Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-16979 MITRE NVD	CVE Title: Microsoft SharePoint Information Disclosure Vulnerability CVSS: CVSS:3.0 5.3/4.6 Base score metrics Attack Vector Network Attack Complexity High Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity None Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is unauthorized file system access - reading from the file system. Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-16979
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Microsoft SharePoint Enterprise Server 2016	4486717 (Security Update)	Important	Information Disclosure	4486677	Base: 5.3 Temporal: 4.6 Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Maybe
Microsoft SharePoint Foundation 2013 Service Pack 1	4486733 (Security Update)	Important	Information Disclosure	4486694	Base: 5.3 Temporal: 4.6 Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Maybe
Microsoft SharePoint Server 2019	4486714 (Security Update)	Important	Information Disclosure	4486676	Base: 5.3 Temporal: 4.6 Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Maybe

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-16979	Steven Seeley (mr_me) of Source Incite

CVE-2020-16997 - Remote Desktop Protocol Server Information Disclosure Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-16997 MITRE NVD	CVE Title: Remote Desktop Protocol Server Information Disclosure Vulnerability CVSS: CVSS:3.0 7.7/6.7 Base score metrics Attack Vector Network Attack Complexity Low Privileges Required Low User Interaction None Scope Changed Confidentiality High Integrity None Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is unauthorized read access to Windows RDP server process. Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-16997
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	4586787 (Security Update)	Important	Information Disclosure	4580327	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	4586787 (Security Update)	Important	Information Disclosure	4580327	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for 32-bit Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for ARM64-based Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for x64-based Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows RT 8.1	4586845 (Monthly Rollup)	Important	Information Disclosure	4580347	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012	4586834 (Monthly Rollup) 4586808 (Security Only)	Important	Information Disclosure	4580382	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	4586834 (Monthly Rollup) 4586808 (Security Only)	Important	Information Disclosure	4580382	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2016	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 1903 (Server Core installation)	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 1909 (Server Core installation)	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 2004 (Server Core installation)	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 20H2 (Server Core Installation)	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 7.7 Temporal: 6.7 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-16997	VictorV (Tang Tianwen)

CVE-2020-16998 - DirectX Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-16998 MITRE NVD	CVE Title: DirectX Elevation of Privilege Vulnerability CVSS: CVSS:3.0 7.0/6.1 Base score metrics Attack Vector Local Attack Complexity High Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation More Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-16998
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	4586787 (Security Update)	Important	Elevation of Privilege	4580327	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	4586787 (Security Update)	Important	Elevation of Privilege	4580327	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for 32-bit Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for ARM64-based Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for x64-based Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 1903 (Server Core installation)	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 1909 (Server Core installation)	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 2004 (Server Core installation)	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 20H2 (Server Core Installation)	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-16998	liuxiaoliang and pjf

CVE-2020-16999 - Windows WalletService Information Disclosure Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-16999 MITRE NVD	CVE Title: Windows WalletService Information Disclosure Vulnerability CVSS: CVSS:3.0 5.5/4.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity None Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is memory layout - the vulnerability allows an attacker to collect information that facilitates predicting addressing of the memory. Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-16999
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	4586787 (Security Update)	Important	Information Disclosure	4580327	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	4586787 (Security Update)	Important	Information Disclosure	4580327	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for 32-bit Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for ARM64-based Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for x64-based Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-16999	k0shl

CVE-2020-17000 - Remote Desktop Protocol Client Information Disclosure Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17000 MITRE NVD	CVE Title: Remote Desktop Protocol Client Information Disclosure Vulnerability CVSS: CVSS:3.0 5.5/4.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity None Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is uninitialized memory. Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17000
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	4586787 (Security Update)	Important	Information Disclosure	4580327	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	4586787 (Security Update)	Important	Information Disclosure	4580327	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for 32-bit Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for ARM64-based Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for x64-based Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows RT 8.1	4586845 (Monthly Rollup)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012	4586834 (Monthly Rollup) 4586808 (Security Only)	Important	Information Disclosure	4580382	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2016	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-17000	Ryelv of Tencent PC Manager

CVE-2020-17001 - Windows Print Spooler Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17001 MITRE NVD	CVE Title: Windows Print Spooler Elevation of Privilege Vulnerability CVSS: CVSS:3.0 7.8/7.0 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Proof-of-Concept Remediation Level Official Fix Report Confidence Confirmed FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17001
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	4586787 (Security Update)	Important	Elevation of Privilege	4580327	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	4586787 (Security Update)	Important	Elevation of Privilege	4580327	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1803 for 32-bit Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1803 for ARM64-based Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1803 for x64-based Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Elevation of Privilege	4580345	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Elevation of Privilege	4580345	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Elevation of Privilege	4580347	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Elevation of Privilege	4580347	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows RT 8.1	4586845 (Monthly Rollup)	Important	Elevation of Privilege	4580347	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Elevation of Privilege	4580378	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Elevation of Privilege	4580378	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Elevation of Privilege	4580378	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Elevation of Privilege	4580378	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Elevation of Privilege	4580345	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Elevation of Privilege	4580345	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2012	4586834 (Monthly Rollup) 4586808 (Security Only)	Important	Elevation of Privilege	4580382	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	4586834 (Monthly Rollup) 4586808 (Security Only)	Important	Elevation of Privilege	4580382	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2012 R2	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Elevation of Privilege	4580347	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Elevation of Privilege	4580347	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2016	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2019	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server, version 1903 (Server Core installation)	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server, version 1909 (Server Core installation)	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server, version 2004 (Server Core installation)	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes
Windows Server, version 20H2 (Server Core Installation)	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 7.0 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-17001	James Forshaw of Google Project Zero

CVE-2020-17004 - Windows Graphics Component Information Disclosure Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17004 MITRE NVD	CVE Title: Windows Graphics Component Information Disclosure Vulnerability CVSS: CVSS:3.0 5.5/4.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity None Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is the contents of Kernel memory. An attacker could read the contents of Kernel memory from a user mode process. Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17004
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	4586787 (Security Update)	Important	Information Disclosure	4580327	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	4586787 (Security Update)	Important	Information Disclosure	4580327	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for 32-bit Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for ARM64-based Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for x64-based Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows RT 8.1	4586845 (Monthly Rollup)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Information Disclosure	4580378	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Information Disclosure	4580378	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Information Disclosure	4580378	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Information Disclosure	4580378	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012	4586834 (Monthly Rollup) 4586808 (Security Only)	Important	Information Disclosure	4580382	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	4586834 (Monthly Rollup) 4586808 (Security Only)	Important	Information Disclosure	4580382	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2016	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 1903 (Server Core installation)	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 1909 (Server Core installation)	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 2004 (Server Core installation)	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 20H2 (Server Core Installation)	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-17004	Jaeseung Choi, Kangsu Kim, Daejin Lee, and Sang Kil Cha of SoftSec Lab

CVE-2020-17019 - Microsoft Excel Remote Code Execution Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17019 MITRE NVD	CVE Title: Microsoft Excel Remote Code Execution Vulnerability CVSS: CVSS:3.0 7.8/6.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required None User Interaction Required Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector. Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17019
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Microsoft Office 2010 Service Pack 2 (32-bit editions)	4484455 (Security Update)	Important	Remote Code Execution	3203462	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Maybe
Microsoft Office 2010 Service Pack 2 (64-bit editions)	4484455 (Security Update)	Important	Remote Code Execution	3203462	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Maybe

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-17019	kdot working with Trend Micro's Zero Day Initiative

CVE-2020-17020 - Microsoft Word Security Feature Bypass Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17020 MITRE NVD	CVE Title: Microsoft Word Security Feature Bypass Vulnerability CVSS: CVSS:3.0 3.3/2.9 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required None User Interaction Required Scope Unchanged Confidentiality Low Integrity None Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: Is the Preview Pane an attack vector for this vulnerability? No, the Preview Pane is not an attack vector. Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Security Feature Bypass

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17020
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Microsoft 365 Apps for Enterprise for 32-bit Systems	Click to Run (Security Update)	Important	Security Feature Bypass	None	Base: 3.3 Temporal: 2.9 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C	No
Microsoft 365 Apps for Enterprise for 64-bit Systems	Click to Run (Security Update)	Important	Security Feature Bypass	None	Base: 3.3 Temporal: 2.9 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C	No
Microsoft Office 2010 Service Pack 2 (32-bit editions)	4486738 (Security Update)	Important	Security Feature Bypass	4486701	Base: 3.3 Temporal: 2.9 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C	Maybe
Microsoft Office 2010 Service Pack 2 (64-bit editions)	4486738 (Security Update)	Important	Security Feature Bypass	4486701	Base: 3.3 Temporal: 2.9 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C	Maybe
Microsoft Office 2019 for 32-bit editions	Click to Run (Security Update)	Important	Security Feature Bypass	None	Base: 3.3 Temporal: 2.9 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C	No
Microsoft Office 2019 for 64-bit editions	Click to Run (Security Update)	Important	Security Feature Bypass	None	Base: 3.3 Temporal: 2.9 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C	No
Microsoft Word 2010 Service Pack 2 (32-bit editions)	4486740 (Security Update)	Important	Security Feature Bypass	4486703	Base: 3.3 Temporal: 2.9 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C	Maybe
Microsoft Word 2010 Service Pack 2 (64-bit editions)	4486740 (Security Update)	Important	Security Feature Bypass	4486703	Base: 3.3 Temporal: 2.9 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C	Maybe
Microsoft Word 2013 RT Service Pack 1	4486730 (Security Update)	Important	Security Feature Bypass	4486692	Base: 3.3 Temporal: 2.9 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C	Maybe
Microsoft Word 2013 Service Pack 1 (32-bit editions)	4486730 (Security Update)	Important	Security Feature Bypass	4486692	Base: 3.3 Temporal: 2.9 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C	Maybe
Microsoft Word 2013 Service Pack 1 (64-bit editions)	4486730 (Security Update)	Important	Security Feature Bypass	4486692	Base: 3.3 Temporal: 2.9 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C	Maybe
Microsoft Word 2016 (32-bit edition)	4486719 (Security Update)	Important	Security Feature Bypass	4486679	Base: 3.3 Temporal: 2.9 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C	Maybe
Microsoft Word 2016 (64-bit edition)	4486719 (Security Update)	Important	Security Feature Bypass	4486679	Base: 3.3 Temporal: 2.9 Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C	Maybe

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-17020	Robert Bares

CVE-2020-17055 - Windows Remote Access Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17055 MITRE NVD	CVE Title: Windows Remote Access Elevation of Privilege Vulnerability CVSS: CVSS:3.0 7.8/6.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17055
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	4586787 (Security Update)	Important	Elevation of Privilege	4580327	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	4586787 (Security Update)	Important	Elevation of Privilege	4580327	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for 32-bit Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for ARM64-based Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for x64-based Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Elevation of Privilege	4580347	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Elevation of Privilege	4580347	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows RT 8.1	4586845 (Monthly Rollup)	Important	Elevation of Privilege	4580347	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Elevation of Privilege	4580347	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Elevation of Privilege	4580347	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 1903 (Server Core installation)	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 1909 (Server Core installation)	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 2004 (Server Core installation)	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 20H2 (Server Core Installation)	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-17055	Yuki Chen

CVE-2020-17056 - Windows Network File System Information Disclosure Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17056 MITRE NVD	CVE Title: Windows Network File System Information Disclosure Vulnerability CVSS: CVSS:3.0 5.5/4.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity None Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is Kernel memory read - unintentional read access to memory contents in kernel space from a user mode process. Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation More Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17056
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	4586787 (Security Update)	Important	Information Disclosure	4580327	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	4586787 (Security Update)	Important	Information Disclosure	4580327	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for 32-bit Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for ARM64-based Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for x64-based Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows RT 8.1	4586845 (Monthly Rollup)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012	4586834 (Monthly Rollup) 4586808 (Security Only)	Important	Information Disclosure	4580382	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	4586834 (Monthly Rollup) 4586808 (Security Only)	Important	Information Disclosure	4580382	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2016	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 1903 (Server Core installation)	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 1909 (Server Core installation)	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 2004 (Server Core installation)	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 20H2 (Server Core Installation)	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-17056	None

CVE-2020-17057 - Windows Win32k Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17057 MITRE NVD	CVE Title: Windows Win32k Elevation of Privilege Vulnerability CVSS: CVSS:3.0 7.0/6.1 Base score metrics Attack Vector Local Attack Complexity High Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation More Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17057
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 Version 1607 for 32-bit Systems	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for 32-bit Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for ARM64-based Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for x64-based Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 1903 (Server Core installation)	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 1909 (Server Core installation)	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 2004 (Server Core installation)	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 20H2 (Server Core Installation)	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.0 Temporal: 6.1 Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-17057	Anonymous working with Trend Micro Zero Day Initiative

CVE-2020-17068 - Windows GDI+ Remote Code Execution Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17068 MITRE NVD	CVE Title: Windows GDI+ Remote Code Execution Vulnerability CVSS: CVSS:3.0 7.8/6.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17068
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	4586787 (Security Update)	Important	Remote Code Execution	4580327	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	4586787 (Security Update)	Important	Remote Code Execution	4580327	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	4586830 (Security Update)	Important	Remote Code Execution	4580346	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	4586830 (Security Update)	Important	Remote Code Execution	4580346	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for 32-bit Systems	4586785 (Security Update)	Important	Remote Code Execution	4580330	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for ARM64-based Systems	4586785 (Security Update)	Important	Remote Code Execution	4580330	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for x64-based Systems	4586785 (Security Update)	Important	Remote Code Execution	4580330	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	4586793 (Security Update)	Important	Remote Code Execution	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	4586793 (Security Update)	Important	Remote Code Execution	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	4586793 (Security Update)	Important	Remote Code Execution	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Remote Code Execution	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Remote Code Execution	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Remote Code Execution	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Remote Code Execution	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Remote Code Execution	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Remote Code Execution	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Remote Code Execution	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Remote Code Execution	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Remote Code Execution	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	4586781 (Security Update)	Important	Remote Code Execution	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Remote Code Execution	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	4586781 (Security Update)	Important	Remote Code Execution	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Remote Code Execution	4580345	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Remote Code Execution	4580345	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Remote Code Execution	4580347	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Remote Code Execution	4580347	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows RT 8.1	4586845 (Monthly Rollup)	Important	Remote Code Execution	4580347	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Remote Code Execution	4580378	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Remote Code Execution	4580378	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Remote Code Execution	4580378	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Remote Code Execution	4580378	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Remote Code Execution	4580345	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Remote Code Execution	4580345	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012	4586834 (Monthly Rollup) 4586808 (Security Only)	Important	Remote Code Execution	4580382	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	4586834 (Monthly Rollup) 4586808 (Security Only)	Important	Remote Code Execution	4580382	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Remote Code Execution	4580347	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Remote Code Execution	4580347	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016	4586830 (Security Update)	Important	Remote Code Execution	4580346	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	4586830 (Security Update)	Important	Remote Code Execution	4580346	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	4586793 (Security Update)	Important	Remote Code Execution	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	4586793 (Security Update)	Important	Remote Code Execution	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 1903 (Server Core installation)	4586786 (Security Update)	Important	Remote Code Execution	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 1909 (Server Core installation)	4586786 (Security Update)	Important	Remote Code Execution	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 2004 (Server Core installation)	4586781 (Security Update)	Important	Remote Code Execution	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 20H2 (Server Core Installation)	4586781 (Security Update)	Important	Remote Code Execution	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-17068	yangkang (@dnpushme)

CVE-2020-17069 - Windows NDIS Information Disclosure Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17069 MITRE NVD	CVE Title: Windows NDIS Information Disclosure Vulnerability CVSS: CVSS:3.0 5.5/4.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity None Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is memory layout - the vulnerability allows an attacker to collect information that facilitates predicting addressing of the memory. Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17069
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	4586787 (Security Update)	Important	Information Disclosure	4580327	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	4586787 (Security Update)	Important	Information Disclosure	4580327	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for 32-bit Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for ARM64-based Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for x64-based Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 7 for 32-bit Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 7 for x64-based Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 8.1 for 32-bit systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 8.1 for x64-based systems	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows RT 8.1	4586845 (Monthly Rollup)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Information Disclosure	4580378	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Information Disclosure	4580378	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Information Disclosure	4580378	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)	4586807 (Monthly Rollup) 4586817 (Security Only)	Important	Information Disclosure	4580378	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)	4586827 (Monthly Rollup) 4586805 (Security Only)	Important	Information Disclosure	4580345	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012	4586834 (Monthly Rollup) 4586808 (Security Only)	Important	Information Disclosure	4580382	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012 (Server Core installation)	4586834 (Monthly Rollup) 4586808 (Security Only)	Important	Information Disclosure	4580382	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2012 R2 (Server Core installation)	4586845 (Monthly Rollup) 4586823 (Security Only)	Important	Information Disclosure	4580347	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2016	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2016 (Server Core installation)	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 1903 (Server Core installation)	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 1909 (Server Core installation)	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 2004 (Server Core installation)	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 20H2 (Server Core Installation)	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-17069	ZiMi and JunGu of Alibaba Orion Security Lab

CVE-2020-17070 - Windows Update Medic Service Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17070 MITRE NVD	CVE Title: Windows Update Medic Service Elevation of Privilege Vulnerability CVSS: CVSS:3.0 7.8/6.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17070
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 Version 1803 for 32-bit Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for ARM64-based Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for x64-based Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 1903 (Server Core installation)	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 1909 (Server Core installation)	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 2004 (Server Core installation)	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 20H2 (Server Core Installation)	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-17070	Zhiniang Peng (@edwardzpeng) and Fangming Gu (@afang5472)

CVE-2020-17071 - Windows Delivery Optimization Information Disclosure Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17071 MITRE NVD	CVE Title: Windows Delivery Optimization Information Disclosure Vulnerability CVSS: CVSS:3.0 5.5/4.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity None Availability None Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is memory layout - the vulnerability allows an attacker to collect information that facilitates predicting addressing of the memory. Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17071
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	4586787 (Security Update)	Important	Information Disclosure	4580327	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	4586787 (Security Update)	Important	Information Disclosure	4580327	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	4586830 (Security Update)	Important	Information Disclosure	4580346	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for 32-bit Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for ARM64-based Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for x64-based Systems	4586785 (Security Update)	Important	Information Disclosure	4580330	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server 2019 (Server Core installation)	4586793 (Security Update)	Important	Information Disclosure	4577668	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 1903 (Server Core installation)	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 1909 (Server Core installation)	4586786 (Security Update)	Important	Information Disclosure	4577671	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 2004 (Server Core installation)	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes
Windows Server, version 20H2 (Server Core Installation)	4586781 (Security Update)	Important	Information Disclosure	4579311	Base: 5.5 Temporal: 4.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-17071	None

CVE-2020-17073 - Windows Update Orchestrator Service Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17073 MITRE NVD	CVE Title: Windows Update Orchestrator Service Elevation of Privilege Vulnerability CVSS: CVSS:3.0 7.8/6.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17073
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 1903 (Server Core installation)	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 1909 (Server Core installation)	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 2004 (Server Core installation)	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 20H2 (Server Core Installation)	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-17073	Zhiniang Peng (@edwardzpeng) & Xuefeng Li

CVE-2020-17074 - Windows Update Orchestrator Service Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17074 MITRE NVD	CVE Title: Windows Update Orchestrator Service Elevation of Privilege Vulnerability CVSS: CVSS:3.0 7.8/6.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17074
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for x64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1909 for x64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for 32-bit Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for ARM64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 2004 for x64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for 32-bit Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for ARM64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 20H2 for x64-based Systems	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 1903 (Server Core installation)	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 1909 (Server Core installation)	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 2004 (Server Core installation)	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows Server, version 20H2 (Server Core Installation)	4586781 (Security Update)	Important	Elevation of Privilege	4579311	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes

Acknowledgements

CVE ID	Acknowledgements
CVE-2020-17074	Zhiniang Peng (@edwardzpeng) & Xuefeng Li

CVE-2020-17075 - Windows USO Core Worker Elevation of Privilege Vulnerability

(top)

CVE ID	Vulnerability Description	Maximum Severity Rating	Vulnerability Impact
CVE-2020-17075 MITRE NVD	CVE Title: Windows USO Core Worker Elevation of Privilege Vulnerability CVSS: CVSS:3.0 7.8/6.8 Base score metrics Attack Vector Local Attack Complexity Low Privileges Required Low User Interaction None Scope Unchanged Confidentiality High Integrity High Availability High Temporal score metrics Exploit Code Maturity Unproven Remediation Level Official Fix Report Confidence Confirmed FAQ: None Mitigations: None Workarounds: None Revision: 1.0    2020-11-10T08:00:00Z     Information published.	Important	Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment	Publicly Disclosed	Exploited
Exploitation Less Likely	No	No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2020-17075
Product	KB Article	Severity	Impact	Supercedence	CVSS Score Set	Restart Required
Windows 10 for 32-bit Systems	4586787 (Security Update)	Important	Elevation of Privilege	4580327	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 for x64-based Systems	4586787 (Security Update)	Important	Elevation of Privilege	4580327	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for 32-bit Systems	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1607 for x64-based Systems	4586830 (Security Update)	Important	Elevation of Privilege	4580346	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for 32-bit Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for ARM64-based Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1803 for x64-based Systems	4586785 (Security Update)	Important	Elevation of Privilege	4580330	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for 32-bit Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for ARM64-based Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1809 for x64-based Systems	4586793 (Security Update)	Important	Elevation of Privilege	4577668	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for 32-bit Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes
Windows 10 Version 1903 for ARM64-based Systems	4586786 (Security Update)	Important	Elevation of Privilege	4577671	Base: 7.8 Temporal: 6.8 Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C	Yes