Apple & Microsoft Patch Tuesday, July 2023 Edition

Summary: Microsoft released updates fixing 130 security bugs in Windows and related software, including at least five flaws already under active exploitation, among them CVE-2023-32049 in Windows SmartScreen, CVE-2023-35311 in Outlook, and privilege escalation flaws CVE-2023-32046 in MSHTML and CVE-2023-36874 in the Windows Error Reporting Service. Apple issued and then quickly pulled an emergency Rapid Security Response update for a Webkit code execution flaw on iOS, iPadOS and macOS Ventura after it caused problems loading certain websites, marking the sixth month this year Apple has shipped zero-day fixes.
What you should know: No patch exists yet for CVE-2023-36884, a remote code execution weakness in Office and Windows that Microsoft links to the Russia-based group Storm-0978, also known as RomCom, which has been associated with ransomware attacks; Rapid7's Adam Barnett advised admins to prepare for an out-of-cycle update, and Microsoft Office is deployed nearly everywhere.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-32046 CVE-2023-32049 CVE-2023-35311 CVE-2023-36874 CVE-2023-36884
Related: Microsoft discloses more than 130 vulnerabilities as part of July’s Patch Tuesday, four exploited in the wild Cyber Risks ·
CVE-2023-36884: Microsoft Windows Search Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jul 17, 2023
CVE-2023-36874: Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Jul 11, 2023