Microsoft Patch Tuesday, December 2023 Edition
Summary: Microsoft released its final Patch Tuesday of 2023 with a relatively small number of security fixes and no known zero-day threats targeting the December batch. Four updates address critical vulnerabilities, including CVE-2023-35628 in MSHTML, which Microsoft says could be triggered by simply receiving an email, and CVE-2023-35641, a remote code execution flaw in the Internet Connection Sharing service rated CVSS 8.8.
Why it matters: CVE-2023-35628 sits in MSHTML, a component used by Office, Outlook, Skype and Teams, and Microsoft's worst case is code execution from an email arriving without the user opening or interacting with it. The non-critical CVE-2023-35636 in Outlook can disclose NTLM hashes, which feed pass-the-hash attacks that let an attacker pose as a legitimate user without logging in.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-23397CVE-2023-35628CVE-2023-35636CVE-2023-35641
- Related
- CVE-2023-23397: Microsoft Office Outlook Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Mar 14, 2023