Microsoft releases lightest Patch Tuesday in three years, no zero-days disclosed
Summary: Microsoft's December Patch Tuesday contained 33 vulnerabilities, its lowest count since December 2019, with no zero-days disclosed after a year in which 10 monthly advisories included an actively exploited flaw. Four critical vulnerabilities were patched, three allowing remote code execution, including CVE-2023-35630 and CVE-2023-35641 in the Internet Connection Sharing service on Windows 10, 11 and Windows Server, and CVE-2023-35628 in the MSHTML Platform that can trigger when Outlook retrieves a crafted email, before the user opens it.
Key Takeaway: The MSHTML flaw fires as Outlook processes the message, so the Preview Pane is enough and no click is required - and the Outlook information disclosure bug CVE-2023-35636 leaks NTLM hashes that feed pass-the-hash follow-on attacks.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-21740CVE-2023-35628CVE-2023-35630CVE-2023-35636CVE-2023-35641
- Related
- Microsoft Patch Tuesday, December 2023 Edition Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026