Largest Patch Tuesday in 3 months includes 5 critical vulnerabilities
Summary: Microsoft's monthly security update disclosed 142 vulnerabilities across its products, five of them critical and the rest rated important, making it the largest Patch Tuesday since April, when 150 were patched. Two critical flaws are rated more likely to be exploited: CVE-2024-38023, a remote code execution vulnerability in SharePoint Server exploitable by an authenticated attacker with Site Owner permissions, and CVE-2024-38060, a remote code execution vulnerability in the Windows Codecs Library triggered by uploading a malicious TIFF file.
What's compelling: Microsoft has acknowledged that CVE-2024-38080, an elevation of privilege vulnerability in Windows Hyper-V, is already being exploited in the wild to gain System privileges, and among the critical flaws CVE-2024-38077 in the Remote Desktop Licensing Service requires no authentication at all.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-38021CVE-2024-38023CVE-2024-38024CVE-2024-38060CVE-2024-38062CVE-2024-38074CVE-2024-38076CVE-2024-38077CVE-2024-38080CVE-2024-38094
- Related
- Microsoft Patch Tuesday, July 2024 Edition Cyber Risks ·CVE-2024-38094: Microsoft Share Point Deserialization Vulnerability Known Exploited Vulnerabilities · Oct 22, 2024CVE-2024-38080: Microsoft Windows Hyper-V Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Jul 09, 2024