Microsoft Patch Tuesday, January 2023 Edition
Summary: Microsoft released updates on January 10, 2023, to fix nearly 100 security flaws in Windows and other software, including 11 rated Critical and an already-exploited Windows elevation-of-privilege flaw, CVE-2023-21674. The release also covers a Critical SharePoint Server bypass, CVE-2023-21743, that lets a remote unauthenticated attacker make an anonymous connection, plus Print Spooler and BitLocker flaws reported or flagged by the NSA and researchers.
Why it matters: CVE-2023-21674 has already been abused in active attacks, and Microsoft says the SharePoint and Exchange flaws are more likely to be exploited, while the SharePoint fix requires a separate upgrade action beyond deploying the update.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-21563CVE-2023-21674CVE-2023-21678CVE-2023-21743
- Related
- CVE-2023-21674: Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Jan 10, 2023