Windows Update Addressed 2 Zero-Days and 52 Other Vulnerabilities

Microsoft has released its Patch Tuesday update, which contains 59 vulnerabilities along with two Zero-Days. The severity for these vulnerabilities ranges from 4.3 (Medium) to eight.8 (High).

Lessons of the vulnerabilities patched embody Info Disclosure (9), Elevation of Privilege (18), Remote Code Execution (26), Security Feature Bypass(3), Spoofing (5) and Denial of Provider (3).

As well, there had been two Chromium vulnerabilities and two Non-Microsoft flaws in AutoDesk and Electron.

Zero Days

The Two zero-days patched by Microsoft had been CVE-2023-36802 – Microsoft Streaming Provider Proxy Elevation of Privilege Vulnerability and CVE-2023-36761 – Microsoft Be aware Info Disclosure Vulnerability.

CVE-2023-36802 native privilege escalation vulnerability also can moreover be exploited by risk actors to invent SYSTEM privileges whereas CVE-2023-36761 also can moreover be exploited for stealing NTLM (Fresh Technology LAN Manager) hashes when opening a MS Region of labor doc.

These hashes can then be cracked to invent secure admission to to the accounts and can moreover be long-established for NTLM Relay assaults.

Amongst the mounted patches, some vulnerabilities had the most life like possible severity of 8.8 (High), which had been CVE-2023-38148 (Web Connection Sharing (ICS) Remote Code Execution Vulnerability) CVE-2023-33136 (Azure DevOps Server Remote Code Execution Vulnerability), CVE-2023-36764 (Microsoft SharePoint Server Elevation of Privilege Vulnerability), CVE-2023-38146 (Dwelling windows Issues Remote Code Execution Vulnerability) and CVE-2023-38147 (Dwelling windows Miracast Wireless Screech Remote Code Execution Vulnerability).

Varied mounted patches and their severity also can moreover be verbalize in the desk below.

It’s miles beneficial that organizations upgrade to the most modern model of patches released by Microsoft to fix these vulnerabilities and forestall them from getting exploited.