CVE-2018-0950

It's 2018 and previewing an email can flash your privates at the world

Microsoft emitted a patch for all supported versions of Outlook on Patch Tuesday this month to prevent attackers harvesting credentials from users who simply preview a carefully crafted Rich Text (RTF) email. The vulnerability (CVE-2018-0950) exploited Outlook’s unfortunate habit of retrieving remotely hosted Object Linking and Embedding (OLE) content when previewing a RTF email. The Windows client was able to authenticate itself if that content was hosted on SMB/CIFS server. If the SMB server...

Adobe's Flash also up the spout Mad March Meltdown! Microsoft's patch for a patch for a patch may need another patch

Microsoft has released the April edition of its monthly security update, this time addressing a total of 63 CVE-listed vulnerabilities. This month's update includes critical fixes for the usual suspects: Windows, Edge, Internet Explorer, and Office, as well as one flaw Redmond previously fixed with an unscheduled update. You should install these fixes as soon as you can, if your system hasn't already. Just one of this month's patches is for a zero-day flaw; CVE-2018-1034 is an elevation of privi...