Microsoft Fixed 74 Bugs Including IE Zero-day That Allow Hackers to Execute Arbitrary Code Remotely in Windows PC

Microsoft released a security update for November 2019 under patch Tuesday and fixed 74 security vulnerabilities that affected various Microsoft products.

Out of 74 vulnerabilities, 13 are marked as “Critical” severity, 61 vulnerabilities categorized as “Important” severity.

The November security release consists of security updates for the following software:

• Microsoft Windows
• Internet Explorer
• Microsoft Edge (EdgeHTML-based)
• ChakraCore
• Microsoft Office and Microsoft Office Services and Web Apps
• Open Source Software
• Microsoft Exchange Server
• Visual Studio
• Azure Stack

Internet Explorer Zero-day Under Active Attack

Microsoft fixed an IE Zero-day remote code execution vulnerability (CVE-2019-1429) that resides in the scripting engine handles objects in memory in Internet Explorer and the vulnerability actively exploiting in wide.

If the attackers successfully exploit the vulnerability, They could corrupt the memory and execute arbitrary code in the context of the current user.

If the users logged in the system as admin, an attacker who successfully exploited the vulnerability could take complete control of an affected system.

Once the attacker gains access, He/she could then install programs; view, change or delete data even create a new account with the complete user rights.

The IE zero-day vulnerability discovered and reported by Google Project Zero, and the vulnerability is still actively exploited in wide.

Microsoft Exchange and Edge RCE

Microsoft also fixed several critical remote code execution vulnerability (CVE-2019-1373) in Microsoft Exchange An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the logged-in user.

Another remote code execution vulnerability (CVE-2019-1426) has been fixed that exists in the way that the scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.

Microsoft Security Update – Critical Vulnerabilities list

Microsoft Exchange Server	CVE-2019-1373	Microsoft Exchange Remote Code Execution Vulnerability	Critical
Microsoft Graphics Component	CVE-2019-1419	Win32k Graphics Remote Code Execution Vulnerability	Critical
Microsoft Graphics Component	CVE-2019-1419	OpenType Font Parsing Remote Code Execution Vulnerability	Critical
Microsoft Scripting Engine	CVE-2019-1426	Scripting Engine Memory Corruption Vulnerability	Critical
Microsoft Scripting Engine	CVE-2019-1429	Scripting Engine Memory Corruption Vulnerability	Critical
Microsoft Scripting Engine	CVE-2019-1427	Scripting Engine Memory Corruption Vulnerability	Critical
Servicing Stack Updates	ADV990001	Latest Servicing Stack Updates	Critical
Windows Hyper-V	CVE-2019-1398	Windows Hyper-V Remote Code Execution Vulnerability	Critical
Windows Hyper-V	CVE-2019-0719	Hyper-V Remote Code Execution Vulnerability	Critical
Windows Hyper-V	CVE-2019-1397	Windows Hyper-V Remote Code Execution Vulnerability	Critical
Windows Hyper-V	CVE-2019-0721	Hyper-V Remote Code Execution Vulnerability	Critical
Windows Hyper-V	CVE-2019-1389	Windows Hyper-V Remote Code Execution Vulnerability	Critical
Windows Media Player	CVE-2019-1430	Microsoft Windows Media Foundation Remote Code Execution Vulnerability	Critical

Since the zero-day under active attack, Microsoft strongly recommended installing these security updates for all the windows users to avoid the security risk and protect your Windows.

You can refer the complete patch details for the full list of vulnerabilities resolved, advisories, in the November 2019 Patch here.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates