Microsoft’s Jan. 2018 Patch Tuesday Lowdown
Summary: Microsoft released 14 security updates on Tuesday, covering the Spectre and Meltdown flaws plus a Microsoft Office zero-day (CVE-2018-0802) being exploited in the wild, and suspended the Spectre/Meltdown patches for computers running AMD chipsets after determining some AMD chipsets did not conform to the documentation Microsoft used to build the mitigations. Of the 56 vulnerabilities addressed in the January Patch Tuesday batch, at least 16 earned Microsoft's critical rating, and Microsoft said Windows 7, 8.1 and 10 users on chips circa 2015 or older, as well as Windows server users on any silicon, are likely to notice a slowdown after applying the update.
What you should know: Microsoft paused the Spectre/Meltdown fixes for AMD machines to prevent them from entering an unbootable state, so a portion of your fleet may be sitting unpatched against flaws that affect most modern computers, smartphones, tablets and mobile devices. Meanwhile an Office zero-day (CVE-2018-0802) was already being exploited in the wild through a booby-trapped document or a malicious or hacked website.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-0802CVE-2018-0819
- Related
- CVE-2018-0802: Microsoft Office Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Bitter APT adds Bangladesh to their targets Cyber Risks ·