Patch Tuesday, October 2024 Edition
Summary: Microsoft released October 2024 security updates fixing at least 117 vulnerabilities in Windows and other software, including two flaws already under active attack. One zero-day, CVE-2024-43573, is the fourth MSHTML vulnerability exploited in the wild in 2024, while the other, CVE-2024-43572, is a code execution bug in the Microsoft Management Console; Adobe also patched 52 holes and Apple fixed a macOS 15 Sequoia bug that broke security tools from CrowdStrike, SentinelOne and Microsoft.
What's compelling: MSHTML, the engine of a browser Microsoft has been retiring, has now produced four exploited-in-the-wild vulnerabilities this year alone, and the MMC flaw follows the GrimResource attack technique that abused crafted MSC files for code execution.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-38259CVE-2024-43572CVE-2024-43573
- Related
- Largest Patch Tuesday since July includes two exploited in the wild, three critical vulnerabilities Cyber Risks ·CVE-2024-43572: Microsoft Windows Management Console Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Oct 08, 2024