Patch Tuesday, December 2018 Edition
Summary: Adobe and Microsoft each released December 2018 security updates, with Microsoft addressing more than three dozen vulnerabilities in Windows and related applications, at least nine of them rated critical. Adobe fixed dozens of holes in Acrobat and Reader and issued an emergency patch for a Flash Player zero-day already exploited in active attacks, while Microsoft patched its own exploited zero-day, CVE-2018-8611, which lets an attacker elevate privileges on all supported Windows versions.
Bottom line: Two flaws in this batch were already being exploited in the wild before patches shipped - CVE-2018-8611 in Windows and the Flash Player zero-day - so any system still unpatched is exposed to attacks that require no new tooling from the adversary.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-8611CVE-2018-8624CVE-2018-8628CVE-2018-8631
- Related
- CVE-2018-8611: Microsoft Windows Kernel Privilege Escalation Vulnerability Known Exploited Vulnerabilities · May 24, 2022Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026