Microsoft Patch Tuesday, February 2020 Edition

Summary: Microsoft released February 2020 updates addressing nearly 100 security holes across Windows and related software, including a dozen rated critical and a patch for an actively exploited Internet Explorer zero-day tracked as CVE-2020-0674. The release also covers a critical Windows shortcut (.lnk) flaw (CVE-2020-0729), an Exchange 2010-2019 bug (CVE-2020-0688) that Microsoft says is likely to be exploited, a SQL Server 2012-2016 issue (CVE-2020-0618), and Adobe shipped fixes for Flash Player, Acrobat/Reader and other products.
What you should know: The IE flaw was already being exploited in the wild before this patch, and the Exchange bug lets an attacker run arbitrary code by sending a single crafted email - both are reachable through ordinary user activity rather than requiring an attacker to already be inside your network.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-1280 CVE-2020-0618 CVE-2020-0674 CVE-2020-0688 CVE-2020-0729
Related: Microsoft Patch Tuesday — Feb. 2020: Vulnerability disclosures and Snort coverage Cyber Risks ·
CVE-2020-0618: Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Sep 18, 2024
CVE-2020-0674: Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021