April’s Patch Tuesday Brings Record Number of Fixes
Summary: Microsoft released updates on April 9, 2024 addressing 147 security holes across Windows, Office, Azure, .NET Framework, Visual Studio, SQL Server, DNS Server, Windows Defender, Bitlocker, and Windows Secure Boot - the largest Patch Tuesday release from Microsoft since at least 2017 and, per Trend Micro's Dustin Childs, the largest of all time. Only three of the April vulnerabilities earned Microsoft's critical rating, and Microsoft later confirmed two zero-days: CVE-2024-21412 and CVE-2024-26234, a proxy driver spoofing weakness.
What's compelling: CVE-2024-29988 lets attackers bypass Windows SmartScreen, and a ZDI researcher found it exploited in the wild even though Microsoft does not list it as exploited - with Childs advising to treat it as in the wild until Microsoft clarifies.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-20670CVE-2024-21412CVE-2024-26234CVE-2024-29063CVE-2024-29988
- Related
- CVE-2024-29988: Microsoft Smart Screen Prompt Security Feature Bypass Vulnerability Known Exploited Vulnerabilities · Apr 30, 2024CVE-2024-21412: Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability Known Exploited Vulnerabilities · Feb 13, 2024Fat Patch Tuesday, February 2024 Edition Cyber Risks ·