Microsoft’s Patch Tuesday machine is humming loudly with software updates to fix at least 76 vulnerabilities in Windows and OS components and the company is warning that some of the bugs have already been exploited in the wild.
Microsoft’s security response team flagged three of the 76 documented flaws in the already-exploited category that typically refers to zero-day malware attacks in the wild.
As is customary, the world’s largest software maker did not provide any technical details of the exploited vulnerabilities or IOCs (indicators of compromise) to help defenders hunt for signs of compromise.
The most serious of the exploited issues is documented as CVE-2023-21823, a Windows graphics component remote code execution vulnerability. “An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” according to a barebones advisory from Redmond that credits researchers at incident response giant Mandiant with reporting the issue.
The company also called special attention to CVE-2023-21715, a feature bypass vulnerability in Microsoft Publisher that’s in the already-exploited category; and CVE-2023-23376, a privilege escalation flaw in Windows common log file system driver.
Microsoft slapped critical-severity ratings on seven of the 76 bulletins and warned that these issues could lead to remote code execution attacks targeting Microsoft Word, Visual Studio and the Windows iSCSI Discovery Service.
The company also shipped important-severity updates for Microsoft Defender, Microsoft Exchange Server, Microsoft Dynamics, 3D Builder, Sharepoint and Microsoft SQL Server.
The industry-wide Patch Tuesday updates also included security fixes from Adobe (critical bugs in After Effects and Illustrator) and Apple (WebKit zero-day exploitation on iOS and macOS).
According to Adobe’s security bulletins, the Illustrator and After Effects patches carry critical-severity ratings because of the risk of code execution attacks.
The WebKit flaw, tracked as CVE-2023-23529, is a type confusion issue that can be exploited for arbitrary code execution by getting the targeted user to access a malicious website. Apple marked this as exploited on its flagship iOS mobile platform.
Related: Apple Patches Actively Exploited WebKit Zero-Day Vulnerability
Related: Microsoft Patch Tuesday: 97 Windows Vulns, 1 Exploited Zero-Day
Related: Zoom Patches High Risk Flaws on Windows, MacOS Platforms
Related: Microsoft Warns of Under-Attack Windows Kernel Flaw
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- Oleria Scores $8M Seed Funding for ID Authentication Technology
- Aembit Scores $16.6M Seed Funding for Workload IAM Technology
- Project Zero: Samsung Mobile Chipsets Vulnerable to Baseband Code Execution Exploits
- Rapid7 Buys Anti-Ransomware Firm Minerva Labs for $38 Million
- Microsoft Pins Outlook Zero-Day Attacks on Russian Actor, Offers Detection Script
- Microsoft Warns of Outlook Zero-Day Exploitation, Patches 80 Security Vulns
- Adobe Warns of ‘Very Limited Attacks’ Exploiting ColdFusion Zero-Day
- Cloud Forensics Startup Mitiga Completes $45M Series A
Latest News
- Zoom Paid Out $3.9 Million in Bug Bounties in 2022
- Oleria Scores $8M Seed Funding for ID Authentication Technology
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- News Analysis: UK Commits $3 Billion to Support National Quantum Strategy
- Malicious NuGet Packages Used to Target .NET Developers
- Google Pixel Vulnerability Allows Recovery of Cropped Screenshots
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Ferrari Says Ransomware Attack Exposed Customer Data
