Microsoft · Security update · December 11, 2018

KB4471321: December 2018 cumulative update for Windows 10 1607

KB4471321, released December 11, 2018, fixes 21 CVEs across 18 products. 2 of them are being exploited (CVE-2018-8639); 2 on CISA KEV. Patch Radar priority: Patch now.

Patch now2 on CISA KEVKnown ransomware use1 publicly disclosed
CVEs closed
21
7 rated Critical
Exploited
2
CVE-2018-8639
Exploitation more likely
15
Vendor assessment
Highest EPSS
0.6849
99th percentile

Priority of the 21 CVEs

Patch now 2 Urgent 17 High 1 Routine 1

Applies to

ProductBuild after install
Internet Explorer 11 on Windows 10 Version 1607 for 32-bit Systems14393.2665
Internet Explorer 11 on Windows 10 Version 1607 for x64-based Systems14393.2665
Internet Explorer 11 on Windows Server 201614393.2665
Microsoft .NET Framework 3.5 on Windows 10 Version 1607 for 32-bit Systems14393.2665
Microsoft .NET Framework 3.5 on Windows 10 Version 1607 for x64-based Systems14393.2665
Microsoft .NET Framework 3.5 on Windows Server 201614393.2665
Microsoft .NET Framework 3.5 on Windows Server 2016 (Server Core installation)14393.2665
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for 32-bit Systems14393.2665
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows 10 Version 1607 for x64-based Systems14393.2665
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 201614393.2665
Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016 (Server Core installation)14393.2665
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for 32-bit Systems14393.2665
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for x64-based Systems14393.2665
Microsoft Edge (EdgeHTML-based) on Windows Server 201614393.2665
Windows 10 Version 1607 for 32-bit Systems14393.2665
Windows 10 Version 1607 for x64-based Systems14393.2665
Windows Server 201614393.2665
Windows Server 2016 (Server Core installation)14393.2665

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2018-8639 Microsoft Graphics Component Information Disclosure 7.0 0.2235 KEVRansomwareExploited
Patch now CVE-2018-8611 Windows Kernel Elevation of Privilege 7.0 0.0420 KEVExploited
Urgent CVE-2018-8631 Internet Explorer Remote Code Execution 6.4 0.6849 More likely
Urgent CVE-2018-8617 Microsoft Scripting Engine Remote Code Execution 4.2 0.6248 More likely
Urgent CVE-2018-8619 Internet Explorer Remote Code Execution 6.4 0.4484 More likely
Urgent CVE-2018-8625 Microsoft Scripting Engine Remote Code Execution 6.4 0.4376 More likely
Urgent CVE-2018-8629 Microsoft Scripting Engine Remote Code Execution 4.2 0.2260 More likely
Urgent CVE-2018-8540 .NET Framework Remote Code Execution n/a 0.2158 Exploitation Less Likely
Urgent CVE-2018-8626 Microsoft Windows DNS Remote Code Execution 9.8 0.2124 Exploitation Less Likely
Urgent CVE-2018-8634 Windows Authentication Methods Remote Code Execution 4.2 0.1536 More likely
Urgent CVE-2018-8624 Microsoft Scripting Engine Remote Code Execution 4.2 0.1321 More likely
Urgent CVE-2018-8618 Microsoft Scripting Engine Remote Code Execution 4.2 0.1089 More likely
Urgent CVE-2018-8643 Microsoft Scripting Engine Remote Code Execution 6.4 0.0991 More likely
Urgent CVE-2018-8596 Microsoft Graphics Component Information Disclosure 4.7 0.0707 More likely
Urgent CVE-2018-8595 Microsoft Graphics Component Information Disclosure 4.7 0.0692 More likely
Urgent CVE-2018-8477 Windows Kernel Information Disclosure 3.3 0.0180 More likely
Urgent CVE-2018-8612 Windows Kernel Denial of Service 4.7 0.0142 More likely
Urgent CVE-2018-8641 Windows Kernel-Mode Drivers Elevation of Privilege 7.0 0.0112 More likely
Urgent CVE-2018-8599 Visual Studio Elevation of Privilege 7.0 0.0100 More likely
High CVE-2018-8517 .NET Framework Denial of Service n/a 0.0567 DisclosedExploitation Unlikely
Routine CVE-2018-8514 Microsoft Windows DNS Information Disclosure 3.3 0.0189 Exploitation Less Likely
Showing 1 to 21 of 21 1