Microsoft Patch Tuesday, December 2021 Edition
Summary: Microsoft, Adobe and Google all released security updates on December 14, 2021, with Microsoft's batch including six previously disclosed flaws and one, CVE-2021-43890 in the Windows AppX installer, already being actively exploited to implant Emotet, Trickbot and BazaLoader. The month's Patch Tuesday was overshadowed by Log4Shell, a critical flaw disclosed December 9 in the Java logging library log4j that allows attackers to force vulnerable servers to execute commands, with Mandiant reporting Chinese and Iranian state actors already leveraging it.
What you should know: Mandiant says Iranian state actors are already exploiting log4j aggressively, including in ransomware operations run for disruption rather than payment, and SANS's Johannes Ullrich warns that dealing with Log4Shell will be a marathon lasting years - so the question is whether you can even enumerate every Java application in your estate that carries the library.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-43890CVE-2021-43905
- Related
- CVE-2021-43890: Microsoft Windows AppX Installer Spoofing Vulnerability Known Exploited Vulnerabilities · Dec 15, 2021Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026