Microsoft has patched 74 flaws in its software as part of the company's Patch Tuesday upgrades for August 2023. Last month's update included 132 vulnerabilities, which seems like progress.
On August Patch Tuesday, Microsoft published 74 new CVEs, six of which were classified critical, and one zero-day vulnerability affecting.NET and Visual Studio. CVE-2023-20593 is a vulnerability that exists outside of the Microsoft product line and is related to the Zenbleed hole in specific AMD processors, requiring administrators to apply a microcode patch or BIOS update on vulnerable computers.
30 Edge flaws have been fixed
In addition, Microsoft fixed 30 bugs in its Chromium-based Edge browser since last month's Patch Tuesday edition, as well as one side-channel weakness affecting certain AMD processor types (CVE-2023-20569 or Inception). According to Microsoft, downloading the new version "stops the attack chain," which led to the remote code execution flaw.
ADV230003 refers to a previously reported security flaw known as CVE-2023-36884, a remote code execution vulnerability in Office and Windows HTML that has been actively exploited by the Russia-linked RomCom threat actor in attacks against Ukraine as well as pro-Ukraine targets in Eastern Europe and North America.
Windows 11 KB5029263: What's new
CVE-2023-38180, a.NET and Visual Studio denial-of-service vulnerability with a CVSS score of 7.5, is the August Patch Tuesday zero-day. Microsoft's CVE notes suggested the existence of proof-of-concept code. Because an attacker does not require privileges to activate the vulnerability, a threat actor with a presence in the organization's infrastructure can start an assault more easily.
Administrators must patch Microsoft Visual Studio 2022, .NET 7.0, .NET 6.0, and ASP.NET Core 2.1, which might take considerable time if a thorough patch management system is not in place.
Patches are also included for five privilege escalation flaws in the Windows Kernel (CVE-2023-35359, CVE-2023-35380, CVE-2023-35382, CVE-2023-35386, and CVE-2023-38154, CVSS scores: 7.8) that could be exploited by a threat actor with local access to the target machine to gain SYSTEM privileges.
Thank you for being a Ghacks reader. The post Microsoft's Patch Tuesday August update fixes 74 flaws appeared first on gHacks Technology News.
0 Commentaires