Microsoft Patch Tuesday for September 2023 — Unusually low 5 critical vulnerabilities included in Microsoft Patch Tuesday, along with two zero-days

Summary: Microsoft disclosed 65 vulnerabilities in its September 2023 Patch Tuesday, only five rated critical, with 56 rated important and two moderate. Two issues were already exploited in the wild: CVE-2023-36802, an elevation of privilege flaw in Microsoft Streaming Service that grants SYSTEM privileges, and CVE-2023-36761 in Microsoft Word, which has public proof-of-concept code and can expose NTLM hashes via the Preview Pane.
Why it matters: Two of this month's flaws were exploited before patches shipped, and one of them, CVE-2023-36802, hands an attacker SYSTEM privileges on a service woven into SharePoint and Office 365. Talos also notes the Lazarus Group APT is using weaponized-file attacks against security developers and researchers, the same method behind four Visual Studio RCE flaws in this release.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-36744 CVE-2023-36745 CVE-2023-36756 CVE-2023-36761 CVE-2023-36762 CVE-2023-36792 CVE-2023-36793 CVE-2023-36794 CVE-2023-36796 CVE-2023-36802
Related: Adobe, Apple, Google & Microsoft Patch 0-Day Bugs Cyber Risks ·
Turns out even the NFL is worried about deepfakes Cyber Risks ·
CVE-2023-36802: Microsoft Streaming Service Proxy Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Sep 12, 2023