Microsoft Patch Tuesday, June 2023 Edition

Summary: Microsoft's June 2023 Patch Tuesday fixed at least 70 security holes, and it appears to be the first Patch Tuesday since March 2022 without a Microsoft zero-day under active exploitation. Microsoft flagged several fixes as more likely to be exploited, led by CVE-2023-29357, a critical SharePoint Server flaw exploitable by an unauthenticated attacker on the same network with a CVSS rating of 9.8.
What's compelling: Three Windows Pragmatic General Multicast bugs (CVE-2023-32015, CVE-2023-32014, CVE-2023-29363) also score 9.8 and can be exploited over the network with no privileges or user interaction, affecting all versions of Windows Server 2008 and later plus Windows 10 and later. The Exchange flaws CVE-2023-32031 and CVE-2023-28310 mirror ProxyNotShell, and as Kevin Breen of Immersive Labs noted, an internal Exchange server without internet-facing authentication is not thereby protected.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-28310 CVE-2023-29357 CVE-2023-29363 CVE-2023-32014 CVE-2023-32015 CVE-2023-32031
Related: Microsoft discloses 5 critical vulnerabilities in June's Patch Tuesday, no zero-days Cyber Risks ·
CVE-2023-29357: Microsoft Share Point Server Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Jan 10, 2024
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026