Patch Tuesday, November 2020 Edition
Summary: Microsoft's November 2020 Patch Tuesday fixed 112 flaws, including 17 critical Windows issues and one zero-day, CVE-2020-17087, a kernel privilege-escalation bug already being exploited in the wild. Google had patched Chrome's CVE-2020-15999 on Oct. 20 after seeing it chained with CVE-2020-17087 to compromise Windows users, and Microsoft drew criticism for restructuring its advisories around CVSS while dropping plain-language vulnerability descriptions.
Why it matters: Tenable CSO Bob Huber warned the stripped advisories leave IT staff 'completely blind to how a particular CVE impacts them' and make patch urgency nearly impossible to judge, while Trend Micro's Dustin Childs said CVE-2020-17051, a 9.8-scored Windows NFS flaw with no description, should be treated as wormable until proven otherwise.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-15999CVE-2020-16875CVE-2020-17051CVE-2020-17087
- Related
- In-the-Wild Series: October 2020 0-day discovery Cyber Risks ·CVE-2020-17087: Microsoft Windows Kernel Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2020-15999: Google Chrome Free Type Heap Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021