Patch Tuesday, October 2021 Edition

Summary: Microsoft released updates fixing more than 70 security holes in Windows and other software, including three critical vulnerabilities that allow remote code execution in Microsoft Word and Windows Hyper-V, and one flaw (CVE-2021-40449) already under active exploitation. Apple separately issued iOS 15.0.2 and iPadOS 15.0.2 to fix a zero-day (CVE-2021-30883) being used in active attacks on iPhone and iPad users.
Bottom line: CVE-2021-36970 is a Windows Print Spooler spoofing flaw rated 'exploitation more likely' and found by the same researchers behind PrintNightmare, which ransomware affiliates folded into their playbook over the summer - so a spooler bug is now a ransomware entry point, not a printing inconvenience.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-26427 CVE-2021-30883 CVE-2021-36970 CVE-2021-38672 CVE-2021-40449 CVE-2021-40461
Related: Microsoft Patch Tuesday for Oct. 2021 — Snort rules and prominent vulnerabilities Cyber Risks ·
Threat Source newsletter (Oct. 14, 2021) Cyber Risks ·
CVE-2021-30883: Apple Multiple Products Memory Corruption Vulnerability Known Exploited Vulnerabilities · May 23, 2022