Cyber Risks · Krebs on Security

Patch Tuesday, October 2023 Edition

Summary: Microsoft released security updates for more than 100 newly-discovered vulnerabilities in Windows and related software, including four flaws already being exploited. Apple separately shipped emergency iOS 17.0.3 and iPadOS 17.0.3 updates for CVE-2023-42724, used in targeted attacks to elevate access on a local device, and CVE-2023-5217, a libvpx codec weakness previously patched as a zero-day by Google in Chrome and by Microsoft in Edge, Teams, and Skype.

Bottom line: CVE-2023-44487 lives in the HTTP/2 protocol itself, not Windows, and attackers have used its 'rapid reset' feature to inflate DDoS attacks for several weeks, prompting advisories from Amazon, Cloudflare, and Google; this is also the 17th zero-day Apple has patched so far this year.

Read the original at Krebs on Security ↗

Topics

Vulnerabilities & Patching

Mentions

CVE-2023-35349CVE-2023-36563CVE-2023-36778CVE-2023-41763CVE-2023-42724CVE-2023-44487CVE-2023-5217

Related

CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability Known Exploited Vulnerabilities · Oct 10, 2023

CVE-2023-36563: Microsoft Word Pad Information Disclosure Vulnerability Known Exploited Vulnerabilities · Oct 10, 2023

CVE-2023-41763: Microsoft Skype for Business Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Oct 10, 2023