SB2018100924 - Information disclosure in Microsoft Windows Media Player

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2018-8481)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to Windows Media Player improperly discloses file information. A remote attacker can open a specially crafted hyperlink and determine the presence of files on disk.

2) Information disclosure (CVE-ID: CVE-2018-8482)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to Windows Media Player improperly discloses file information. A remote attacker can open a specially crafted hyperlink and determine the presence of files on disk.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8481
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8482