VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Jul 15, 2019· Updated Jun 17, 2026

CVE-2019-1084

CVE-2019-1084

Description

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters. An authenticated attacker could exploit this vulnerability by creating entities with invalid display names, which, when added to conversations, remain invisible. This security update addresses the issue by validating display names upon creation in Microsoft Exchange, and by rendering invalid display names correctly in Microsoft Outlook clients., aka 'Microsoft Exchange Information Disclosure Vulnerability'.

Affected products

37
  • Microsoft/Exchange Server10 versions
    cpe:2.3:a:microsoft:exchange_server:2010:sp2:*:*:*:*:*:*+ 9 more
    • cpe:2.3:a:microsoft:exchange_server:2010:sp2:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_23:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:*
    • (no CPE)range: 2010 Service Pack 3
    • (no CPE)range: Cumulative Update 23
    • (no CPE)range: Cumulative Update 12
    • (no CPE)range: Cumulative Update 1
  • Microsoft/Lync3 versions
    cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:*
    • (no CPE)range: 2013 Service Pack 1 (32-bit)
    • (no CPE)range: 2013 Service Pack 1 (32-bit)
  • Microsoft/Lync Basic
    cpe:2.3:a:microsoft:lync_basic:2013:sp1:*:*:*:*:*:*
  • Microsoft/Mail And Calendar
    cpe:2.3:a:microsoft:mail_and_calendar:-:*:*:*:*:*:*:*
  • Microsoft/Office6 versions
    cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:office:2016:*:*:*:*:mac_os:*:*
    • cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:office:2019:*:*:*:*:macos:*:*
  • Microsoft/Office 365 Proplus2 versions
    cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:*
    • (no CPE)range: 32-bit Systems
  • Microsoft/Outlook5 versions
    cpe:2.3:a:microsoft:outlook:-:*:*:*:*:iphone_os:*:*+ 4 more
    • cpe:2.3:a:microsoft:outlook:-:*:*:*:*:iphone_os:*:*
    • cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*
    • cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:android:*:*
    • (no CPE)range: 2010 Service Pack 2 (32-bit editions)
  • Microsoft/Skype For Business2 versions
    cpe:2.3:a:microsoft:skype_for_business:2016:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:microsoft:skype_for_business:2016:*:*:*:*:*:*:*
    • (no CPE)range: 2016 (32-bit)
  • Microsoft/Skype For Business Basic2 versions
    cpe:2.3:a:microsoft:skype_for_business_basic:2016:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:microsoft:skype_for_business_basic:2016:*:*:*:*:*:*:*
    • (no CPE)range: 2016 (32-bit)
  • Microsoft/Exchange 2000llm-create
  • Microsoft/Mail and Calendarv5
    Range: unspecified
  • Microsoft/Office Visiocpe-rescue
    Range: 2013 Service Pack 1 (32-bit editions)
  • Microsoft/Outlook for Androidcpe-rescue
    Range: unspecified
  • Microsoft/Outlook for iOScpe-rescue
    Range: unspecified

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.