Microsoft Patch Tuesday, June 2022 Edition
Summary: Microsoft released updates fixing 60 security vulnerabilities in Windows and other software, including a zero-day in all supported Office versions on all Windows flavors that had seen active exploitation for at least two months. Three bugs earned the critical label, led by CVE-2022-30190, the MSDT flaw dubbed Follina, which uses a Word feature to fetch an HTML file from a remote server that then loads code and executes PowerShell commands without macros.
What's compelling: Follina bypasses macro-based scanning entirely, and researcher Kevin Beaumont reported that researchers flagged the MSDT issue to Microsoft in March 2021 and again on April 12, 2022, when Microsoft closed the ticket as not a security issue before finally issuing a CVE on May 30.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-30190
- Related
- CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Jun 14, 2022