Skip to content ↓ | Skip to navigation ↓

Today’s VERT Alert addresses Microsoft’s April 2020 Security Updates. VERT is actively working on coverage for these vulnerabilities and expects to ship ASPL-880 on Wednesday, April 15th.

In-The-Wild & Disclosed CVEs

CVE-2020-0935

A vulnerability in the OneDrive for Windows desktop application could allow an attacker to overwrite a targeted file and ultimately allow code execution with elevated privileges. The attacker must already have the ability to run code on the system. The vulnerability was resolved by changing how OneDrive for Windows handles symbolic links. The application will automatically update on Internet connected devices.

Microsoft has rated this as a 2 (Exploitation Less Likely) on the latest software release on the Exploitability Index.

CVE-2020-0938

A vulnerability exists in the Windows Adobe Type Manager Library’s handling of Adobe Type 1 PostScript format fonts. Attacks against systems other than Windows 10 could lead to full code execution. On Windows 10, the AppContainer sandbox will limit the impact of successful exploitation. This is one of two zero day vulnerabilities addressed in today’s update release.

Microsoft has rated this as a 2 (Exploitation Less Likely) on the latest software release and a 0 (Exploitation Detected) on older software releases on the Exploitability Index.

CVE-2020-0968

A vulnerability in the Microsoft Scripting Engine could allow for code execution in the context of the logged in user. Exploiting this vulnerability would require that the victim visit a malicious web page or load malicious content via an ActiveX control or a Microsoft Office document.

Microsoft has rated this as a 1 (Exploitation More Likely) on the latest software release on the Exploitability Index.

CVE-2020-1020

A vulnerability exists in the Windows Adobe Type Manager Library’s handling of Adobe Type 1 PostScript format fonts. Attacks against systems other than Windows 10 could lead to full code execution. On Windows 10, the AppContainer sandbox will limit the impact of successful exploitation. This is the second zero day vulnerability addressed in today’s update release.

Microsoft has rated this as a 2 (Exploitation Less Likely) on the latest software release and a 0 (Exploitation Detected) on older software releases on the Exploitability Index.

CVE Breakdown by Tag

While historical Microsoft Security Bulletin groupings are gone, Microsoft vulnerabilities are tagged with an identifier. This list provides a breakdown of the CVEs on a per tag basis.

Tag
CVE Count
CVEs
Windows Defender
2
CVE-2020-0835, CVE-2020-1002
Windows Update Stack
4
CVE-2020-0985, CVE-2020-0996, CVE-2020-0983, CVE-2020-1014
Windows Hyper-V
3
CVE-2020-0910, CVE-2020-0917, CVE-2020-0918
Open Source Software
1
CVE-2020-1026
Microsoft JET Database Engine
10
CVE-2020-0988, CVE-2020-0992, CVE-2020-0994, CVE-2020-0995, CVE-2020-0999, CVE-2020-1008, CVE-2020-0889, CVE-2020-0953, CVE-2020-0959, CVE-2020-0960
Microsoft Windows
15
CVE-2020-0794, CVE-2020-0944, CVE-2020-1001, CVE-2020-1006, CVE-2020-1029, CVE-2020-0934, CVE-2020-0940, CVE-2020-0942, CVE-2020-0965, CVE-2020-0981, CVE-2020-1009, CVE-2020-1011, CVE-2020-1016, CVE-2020-1017, CVE-2020-1094
Microsoft Windows DNS
1
CVE-2020-0993
Apps
1
CVE-2020-1019
Microsoft Graphics Component
12
CVE-2020-0784, CVE-2020-0907, CVE-2020-0987, CVE-2020-1004, CVE-2020-1005, CVE-2020-0687, CVE-2020-0938, CVE-2020-0952, CVE-2020-0958, CVE-2020-0964, CVE-2020-0982, CVE-2020-1020
Android App
1
CVE-2020-0943
Remote Desktop Client
1
CVE-2020-0919
Visual Studio
2
CVE-2020-0899, CVE-2020-0900
Windows Kernel
14
CVE-2020-0913, CVE-2020-0955, CVE-2020-1000, CVE-2020-1003, CVE-2020-1007, CVE-2020-1027, CVE-2020-0699, CVE-2020-0821, CVE-2020-0888, CVE-2020-0936, CVE-2020-0956, CVE-2020-0957, CVE-2020-0962, CVE-2020-1015
Windows Media
8
CVE-2020-0945, CVE-2020-0946, CVE-2020-0947, CVE-2020-0948, CVE-2020-0949, CVE-2020-0950, CVE-2020-0937, CVE-2020-0939
Microsoft Dynamics
4
CVE-2020-1018, CVE-2020-1022, CVE-2020-1049, CVE-2020-1050
Microsoft Office
9
CVE-2020-0760, CVE-2020-0906, CVE-2020-0931, CVE-2020-0935, CVE-2020-0979, CVE-2020-0980, CVE-2020-0991, CVE-2020-0961, CVE-2020-0984
Microsoft Scripting Engine
6
CVE-2020-0895, CVE-2020-0966, CVE-2020-0967, CVE-2020-0968, CVE-2020-0969, CVE-2020-0970
Microsoft Office SharePoint
19
CVE-2020-0920, CVE-2020-0923, CVE-2020-0924, CVE-2020-0925, CVE-2020-0926, CVE-2020-0927, CVE-2020-0929, CVE-2020-0930, CVE-2020-0932, CVE-2020-0933, CVE-2020-0954, CVE-2020-0971, CVE-2020-0972, CVE-2020-0973, CVE-2020-0974, CVE-2020-0975, CVE-2020-0976, CVE-2020-0977, CVE-2020-0978

Other Information

There were no additional advisories released today.

The Executive's Guide to the Top 20 Critical Security Controls