Patch Tuesday, November 2018 Edition
Summary: Microsoft released 16 software updates on Tuesday fixing more than 60 security holes across Windows and other Microsoft products, with most critical flaws residing in Edge and Internet Explorer. The batch addresses a zero-day (CVE-2018-8589) already exploited against Windows 7 and Server 2008 systems and a publicly disclosed Bitlocker bug (CVE-2018-8566) that could expose encrypted data, though both require the attacker to already be logged in.
What you should know: One of the patched flaws is a zero-day already being used in the wild against Windows 7 and Server 2008, and Qualys reports public code that can force Acrobat and Reader to leak a Windows password hash crackable with open-source tools.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-8566CVE-2018-8589
- Related
- CVE-2018-8589: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · May 23, 2022Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026