Microsoft discloses only three critical vulnerabilities in November’s Patch Tuesday update, three other zero-days
Summary: Microsoft's November Patch Tuesday update contains 57 vulnerabilities, only three of them rated critical and 54 rated important, the fewest Microsoft has disclosed in a month since May. The release includes three zero-days exploited in the wild - CVE-2023-36033 in the Windows DWM Core Library and CVE-2023-36036 in the Windows Cloud Files mini-filter driver, both elevation of privilege flaws leading to SYSTEM privileges, and CVE-2023-36025, which bypasses Windows Defender SmartScreen checks - plus another three vulnerabilities that were already publicly disclosed.
Why it matters: Three of this month's flaws are already being exploited, and CVE-2023-36033 has proof-of-concept code available, so the small patch count does not mean a light month for defenders.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-36025CVE-2023-36033CVE-2023-36036CVE-2023-36041CVE-2023-36397
- Related
- Microsoft Patch Tuesday, November 2023 Edition Cyber Risks ·We all just need to agree that ad blockers are good Cyber Risks ·CVE-2023-36036: Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 14, 2023