Microsoft Patch Tuesday for May 2023 — Fewest vulnerabilities disclosed in a month in three-plus years
Summary: Microsoft disclosed 40 vulnerabilities in its May 2023 Patch Tuesday, the fewest since December 2019, including seven critical and 33 important issues. Two of the vulnerabilities were being actively exploited in the wild, the fourth consecutive month that was the case, including CVE-2023-29336, an elevation of privilege flaw in the Win32k kernel mode driver that can yield SYSTEM privileges.
Why it matters: The most serious flaw, CVE-2023-24941, is a Windows Network File System remote code execution vulnerability rated 9.8 out of 10 that an unauthenticated attacker can trigger over the network with a crafted call to an NFS service.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2023-24941CVE-2023-24955CVE-2023-29324CVE-2023-29325CVE-2023-29336
- Related
- Microsoft Patch Tuesday, May 2023 Edition Cyber Risks ·CVE-2023-24955: Microsoft Share Point Server Code Injection Vulnerability Known Exploited Vulnerabilities · Mar 26, 2024CVE-2023-29336: Microsoft Win32K Privilege Escalation Vulnerability Known Exploited Vulnerabilities · May 09, 2023