Patch Tuesday, December 2019 Edition

Summary: Microsoft released December 2019 updates fixing three dozen security holes in Windows and other software, including seven critical bugs and a Win32k privilege-escalation flaw, CVE-2019-1458, already exploited in the wild across Windows 7 through 10 and Windows Server 2008-2019. The advisory also covers CVE-2019-1468, a critical Windows font library flaw exploitable by getting a user to visit a malicious site, and CVE-2019-1489, an RDP client bug patched only for Windows XP Service Pack 3.
Bottom line: CVE-2019-1458 is already being exploited, and its exploit resembles CVE-2019-0859, which Recorded Future found being sold in underground markets; Windows 7 and Windows Server 2008 stop receiving security updates after January 14, 2020.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-0859 CVE-2019-1458 CVE-2019-1468 CVE-2019-1489
Related: Microsoft Patch Tuesday — Dec. 2019: Vulnerability disclosures and Snort coverage Cyber Risks ·
CVE-2019-1458: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Jan 10, 2022
CVE-2019-0859: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021