The March 2023 Patch Tuesday Security Update Review | Qualys
Summary: Microsoft's March 2023 Patch Tuesday addressed 101 vulnerabilities, including 22 in Microsoft Edge (Chromium-based), with nine rated critical, 70 important, and one moderate. Two zero-days known to be exploited in the wild, CVE-2023-24880 and CVE-2023-23397, were added to CISA's Known Exploitable Vulnerabilities Catalog after the update was released.
Why it matters: CVE-2023-23397 can be triggered automatically when Outlook retrieves and processes a crafted email, before it is viewed in the Preview Pane, and Microsoft attributes its exploitation in targeted attacks against European military, transportation, energy, and government companies to APT28, tied to Russia's GRU, with up to 15 companies affected and the most recent incident in December.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-23397CVE-2023-24880CVE-2023-26360
- Related
- Microsoft Patch Tuesday, March 2023 Edition Cyber Risks ·Fat Patch Tuesday, February 2024 Edition Cyber Risks ·