Microsoft Patch Tuesday, January 2021 Edition

Summary: Microsoft released updates for more than 80 security holes in Windows and other software, including one flaw under active exploitation and another disclosed before today, with ten rated critical. The most concerning is CVE-2021-1647, a critical bug in Windows Defender that is being actively exploited, while CVE-2020-1660 is a remote code execution flaw in nearly every Windows version with a CVSS score of 8.8.
What's compelling: The Defender flaw could be as simple as sending a file, since the user need not interact with anything for Defender to access it, and the RPC bugs sit in a component whose earlier vulnerabilities powered some of the most memorable worms of the last decade.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2018-8514 CVE-2019-1409 CVE-2019-1458 CVE-2020-1660 CVE-2021-1647 CVE-2021-1648 CVE-2021-1709
Related: Microsoft Patch Tuesday for Jan. 2021 — Snort rules and prominent vulnerabilities Cyber Risks ·
CVE-2019-1458: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Jan 10, 2022
CVE-2021-1647: Microsoft Defender Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021