medium6.5
CVE-2019-1084
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters.
Impact
An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Exchange Server | Versions 2010, 2013, 2016 |
| Microsoft | Lync | Version 2013 |
| Microsoft | Lync Basic | Version 2013 |
| Microsoft | Mail And Calendar | All versions |
| Microsoft | Office | Versions 2010, 2013, 2016, 2019 |
| Microsoft | Office 365 Proplus | All versions |
| Microsoft | Outlook | All versions Versions 2013, 2016 |
| Microsoft | Skype For Business | Version 2016 |
| Microsoft | Skype For Business Basic | Version 2016 |