Bug Left Some Windows PCs Dangerously Unpatched
Summary: Microsoft released updates fixing at least 79 security vulnerabilities in Windows and related software, including a critical bug, CVE-2024-43491, that rolled back fixes for previously exploited vulnerabilities on some Windows 10 systems produced in 2015 that installed updates from March through August 2024. Microsoft also disclosed two zero-day flaws, CVE-2024-38226 in Microsoft Publisher and CVE-2024-38217, both Mark of the Web bypasses requiring a target to open a booby-trapped Office file, plus an actively exploited elevation-of-privilege bug in Windows Installer tracked as CVE-2024-38014.
What you should know: Some Windows 10 machines spent months silently unpatched against vulnerabilities already known to be exploited, and Microsoft says correcting it requires applying both the September 2024 Servicing Stack Update and the September 2024 Windows Security Updates. CVE-2024-38217 already has a public write-up and exploit code on GitHub, so the window between disclosure and attempted use is effectively closed.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-38014CVE-2024-38217CVE-2024-38226CVE-2024-43491
- Related
- Four zero-days included in group of 79 vulnerabilities Microsoft discloses, including one with 9.8 severity score Cyber Risks ·CVE-2024-38226: Microsoft Publisher Protection Mechanism Failure Vulnerability Known Exploited Vulnerabilities · Sep 10, 2024CVE-2024-38014: Microsoft Windows Installer Improper Privilege Management Vulnerability Known Exploited Vulnerabilities · Sep 10, 2024