Saturday, December 2, 2023

Microsoft Security Updates Fixes for 88 Vulnerabilities Including 4 SandboxEscaper Leaked Zero-day’s

Microsoft released a new security update for June 2016 under patch Tuesday that fixes of 88 vulnerabilities including that affected different Microsoft products.

In this June update, Microsoft fixed the vulnerabilities that affected the following software,

  • Microsoft Windows
  • Internet Explorer
  • Microsoft Edge
  • Microsoft Office and Microsoft Office Services and Web Apps
  • ChakraCore
  • Skype for Business and Microsoft Lync
  • Microsoft Exchange Server
  • Azure

Microsoft also fixed 4 previous unknown zero-day vulnerabilities that leaked by SandboxEscaper, but none of those vulnerabilities contains neither active exploits nor incorporate the malware.

CVE-2019-0973 – Windows Installer Elevation of Privilege Vulnerability
CVE-2019-1053 – Windows Shell Elevation of Privilege Vulnerability 
CVE-2019-1064 – Windows Elevation of Privilege Vulnerability
CVE-2019-1069 – Task Scheduler Elevation of Privilege Vulnerability 

SandboxEscaper posted all the vulnerability details with PoC Exploits in her GitHub over a month, at this moment, out of five, four zero-day bugs are fixed and the remaining one isn’t ready yet since it leaked very recently.

Total of 88 vulnerabilities that were patched by Microsoft this month, 21 vulnerabilities are rated critical, 66 rated important and one moderate.

Microsoft released an advisory for third-party vulnerabilities fixes including Adobe Flash Player, Microsoft Devices, Servicing Stack Updates.

The Advisory including the Bluetooth Low Energy vulnerability that was disclosed in May. “Due to a misconfiguration in the Bluetooth pairing protocols, it is possible for an attacker who is physically close to a user at the moment he/she uses the security key to communicate with the security key.”

Google and Feitian have issued advisories for customers of these keys and Google issued CVE-2019-2102 for this vulnerability.

There are two moderate vulnerabilities CVE-2019-1040 and CVE-2019-1019 were patched by Microsoft that allowed attackers to remotely execute malicious code on any Windows machine or authenticate to any web server

Microsoft Also Fixed the two potentially remote code execution vulnerabilities in Microsoft Word (CVE-2019-1034 and CVE-2019-1035), and vulnerability affects all versions of Microsoft Word on Windows and Mac.

You can refer the complete patch details for the full list of vulnerabilities resolved, advisories, in the June 2019 Patch here.

Microsoft strongly recommended installing these security updates for all the windows users to avoid the security risk and protect your Windows.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep yourself updated.

Also Read

Microsoft Released Security updates & Fixed 74 Vulnerabilities Including 2 Latest Zero-day

Microsoft Released Security Updates that Fixes 64 Vulnerabilities Including 2 Active Zero-day Flaw

Microsoft Released Security Updates & Fixed More than 70 Flaws Along with Active Zero-Day Browser Bug


Latest articles

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

CISA Warns Hackers Exploiting Wastewater Systems Logic Controllers

In a disconcerting turn of events, cyber threat actors have set their sights on...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles