Microsoft Patches Six Zero-Day Security Holes
Summary: Microsoft's June Patch Tuesday fixed 49 security holes, including six zero-day bugs that attackers are already exploiting in active attacks. The zero-days include CVE-2021-33742, a remote code execution flaw in a Windows HTML component, and CVE-2021-31956, an elevation of privilege flaw in Windows NTFS, alongside four other elevation of privilege and information disclosure bugs.
Key Takeaway: Two of the Windows zero-days, CVE-2021-31201 and CVE-2021-31199, are tied to an actively exploited Adobe Acrobat and Reader flaw, CVE-2021-28550, which attackers trigger by sending crafted PDFs in phishing emails, and there are no workarounds for these vulnerabilities.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-28550CVE-2021-31199CVE-2021-31201CVE-2021-31955CVE-2021-31956CVE-2021-31959CVE-2021-31963CVE-2021-33739CVE-2021-33742
- Related
- CVE-2021-31201: Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2021-31956: Microsoft Windows NTFS Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021