Patch Tuesday, March 2024 Edition

Summary: Microsoft patched at least 60 Windows vulnerabilities, six of which Microsoft rates as more likely to be exploited, mostly elevation-of-privilege flaws in components including the Windows Kernel, CimFS, Graphics Component and Print Spooler. Apple's macOS Sonoma 14.4 update addresses at least 68 security weaknesses, and its iOS 17.4, iPadOS 17.4 and iOS 16.7.6 updates fix two zero-day flaws, CVE-2024-23225 and CVE-2024-23296, that were being exploited in the wild.
What you should know: CVE-2024-21334 in Azure's Open Management Infrastructure carries a CVSS score of 9.8, and Microsoft says attackers could reach OMI instances over the Internet without authentication and gain remote code execution. Separately, CVE-2024-21390 in Microsoft Authenticator lets an attacker who already has a foothold on a device steal multi-factor authentication codes and lock the user out by replacing the MFA device.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-21334 CVE-2024-21390 CVE-2024-21433 CVE-2024-21435 CVE-2024-21437 CVE-2024-23225 CVE-2024-23296 CVE-2024-26170 CVE-2024-26182
Related: CVE-2024-23296: Apple Multiple Products Memory Corruption Vulnerability Known Exploited Vulnerabilities · Mar 06, 2024
CVE-2024-23225: Apple Multiple Products Memory Corruption Vulnerability Known Exploited Vulnerabilities · Mar 06, 2024
Another Patch Tuesday with no zero-days, only two critical vulnerabilities disclosed by Microsoft Cyber Risks ·