Patch Tuesday Lowdown, April 2019 Edition
Summary: Microsoft released fifteen software updates fixing more than 70 unique security vulnerabilities across Windows, IE, Edge, Office, Sharepoint and Exchange, including at least two zero-day bugs. Rapid7 reported that CVE-2019-0803 and CVE-2019-0859 are already being exploited in the wild for privilege elevation on all supported Windows versions, and Adobe separately issued updates for Acrobat/Reader, Flash Player and AIR while Shockwave Player reached end-of-life.
What you should know: Two privilege-escalation flaws are already exploited in the wild, and Rapid7's Greg Wiseman noted one of the 32 RCE vulnerabilities patched today could be chained with them to obtain full control of a system. Ivanti's Chris Goettl added that 7 vulnerabilities will remain exposed for most existing Shockwave installs, with an exploit imminent.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2019-0803CVE-2019-0859
- Related
- CVE-2019-0859: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021CVE-2019-0803: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Patch Tuesday, December 2019 Edition Cyber Risks ·