Patch Tuesday, December 2017 Edition
Summary: Microsoft and Adobe released their final Patch Tuesday updates of 2017, with Microsoft addressing more than 30 vulnerabilities across Windows, Edge, Office, Exchange and its Malware Protection Engine, and Adobe updating Flash Player to v. 28.0.0.126. The Malware Protection Engine fix, first issued out-of-band the prior week, addressed a flaw that could be exploited via a booby-trapped file scanned by Windows Defender, and Microsoft said the U.K.'s National Cyber Security Centre reported the bug to it.
What's compelling: The flaw sat in the anti-malware engine embedded in most modern Windows installs, meaning the component meant to catch malicious files could itself be triggered by one - and Microsoft said it was not aware of active attacks, so the window between disclosure and exploitation is the stake.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026