CVE-2019-1084: Infoleak
First published: Mon Jul 15 2019(Updated: )
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.
Credit: secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Exchange Server | =2010-sp2 | |
| Microsoft Exchange Server | =2013-cumulative_update_23 | |
| Microsoft Exchange Server | =2016-cumulative_update_1 | |
| Microsoft Exchange Server | =2016-cumulative_update_12 | |
| Microsoft Exchange Server | =2016-cumulative_update_13 | |
| Microsoft Exchange Server | =2016-cumulative_update_2 | |
| Microsoft Lync | =2013-sp1 | |
| Microsoft Lync Basic | =2013-sp1 | |
| Microsoft mail and calendar | ||
| Microsoft Office | =2010-sp2 | |
| Microsoft Office | =2013-sp1 | |
| Microsoft Office | =2016 | |
| Microsoft Office for Mac OS X | =2016 | |
| Microsoft Office | =2019 | |
| Microsoft Office | =2019 | |
| Microsoft Office 365 ProPlus | ||
| Microsoft Outlook for iOS | ||
| Microsoft Outlook | =2013-sp1 | |
| Microsoft Outlook | =2016 | |
| Microsoft Outlook Android | =2016 | |
| Microsoft Skype for Business | =2016 | |
| Microsoft Skype for Business Basic | =2016 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2019-1084?
CVE-2019-1084 is an information disclosure vulnerability that exists when Exchange allows creation of entities with Display Names having non-printable characters.
How can an attacker exploit CVE-2019-1084?
An authenticated attacker could exploit CVE-2019-1084 by creating entities with invalid display names, which, when added to conversations, remain invisible.
Which software versions are affected by CVE-2019-1084?
CVE-2019-1084 affects Microsoft Exchange Server 2010 SP2, Microsoft Exchange Server 2013 Cumulative Update 23, and Microsoft Exchange Server 2016 Cumulative Update 1, 12, 13, and 2.
What is the severity of CVE-2019-1084?
The severity of CVE-2019-1084 is medium, with a severity value of 6.5.
How can I fix CVE-2019-1084?
To fix CVE-2019-1084, apply the security updates provided by Microsoft. Refer to the Microsoft Security Advisory for more information.
- agent/type
- agent/weakness
- agent/severity
- agent/author
- agent/references
- agent/remedy
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/microsoft
- canonical/microsoft exchange server
- version/microsoft exchange server/2010-sp2
- version/microsoft exchange server/2013-cumulative_update_23
- version/microsoft exchange server/2016-cumulative_update_1
- version/microsoft exchange server/2016-cumulative_update_12
- version/microsoft exchange server/2016-cumulative_update_13
- version/microsoft exchange server/2016-cumulative_update_2
- canonical/microsoft lync
- version/microsoft lync/2013-sp1
- canonical/microsoft lync basic
- version/microsoft lync basic/2013-sp1
- canonical/microsoft mail and calendar
- canonical/microsoft office
- version/microsoft office/2010-sp2
- version/microsoft office/2013-sp1
- version/microsoft office/2016
- canonical/microsoft office for mac os x
- version/microsoft office for mac os x/2016
- version/microsoft office/2019
- canonical/microsoft office 365 proplus
- canonical/microsoft outlook for ios
- canonical/microsoft outlook
- version/microsoft outlook/2013-sp1
- version/microsoft outlook/2016
- canonical/microsoft outlook android
- version/microsoft outlook android/2016
- canonical/microsoft skype for business
- version/microsoft skype for business/2016
- canonical/microsoft skype for business basic
- version/microsoft skype for business basic/2016