Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2019-1084

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
microsoft

Description

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Microsoft Microsoft Exchange Server

  • 2010 Service Pack 3affected

Microsoft Microsoft Outlook

  • 2010 Service Pack 2 (32-bit editions)affected
  • 2010 Service Pack 2 (64-bit editions)affected
  • 2016 (32-bit edition)affected
  • 2016 (64-bit edition)affected
  • 2013 Service Pack 1 (32-bit editions)affected
  • 2013 Service Pack 1 (64-bit editions)affected

Microsoft Microsoft Office

  • 2013 Service Pack 1 (32-bit editions)affected
  • 2013 Service Pack 1 (64-bit editions)affected
  • 2013 RT Service Pack 1affected
  • 2016 for Macaffected
  • 2016 (32-bit edition)affected
  • 2016 (64-bit edition)affected
  • 2019 for 32-bit editionsaffected
  • 2019 for 64-bit editionsaffected
  • 2019 for Macaffected

Microsoft Microsoft Lync

  • 2013 Service Pack 1 (32-bit)affected
  • 2013 Service Pack 1 (64-bit)affected

Microsoft Microsoft Lync Basic

  • 2013 Service Pack 1 (32-bit)affected
  • 2013 Service Pack 1 (64-bit)affected

Microsoft Microsoft Outlook for Android

  • unspecifiedaffected

Microsoft Skype for Business

  • 2016 (32-bit)affected
  • 2016 (64-bit)affected

Microsoft Skype for Business Basic

  • 2016 (32-bit)affected
  • 2016 (64-bit)affected

Microsoft Office 365 ProPlus

  • 32-bit Systemsaffected
  • 64-bit Systemsaffected

Microsoft Microsoft Exchange Server 2016

  • Cumulative Update 12affected
  • Cumulative Update 13affected

Microsoft Microsoft Exchange Server 2019

  • Cumulative Update 1affected
  • Cumulative Update 2affected

Microsoft Microsoft Exchange Server 2013

  • Cumulative Update 23affected

Microsoft Mail and Calendar

  • unspecifiedaffected

Microsoft Outlook for iOS

  • unspecifiedaffected

References