Sunday, February 23, 2025
HomeCVE/vulnerabilityMicrosoft's 2023 Final Patch: 34 Vulnerabilities Including Critical 0-Day Fixed

Microsoft’s 2023 Final Patch: 34 Vulnerabilities Including Critical 0-Day Fixed

Published on

SIEM as a Service

Follow Us on Google News

Microsoft has released their patches for December 2023 as part of their Patch Tuesday. In this release, they have patched more than 34 vulnerabilities and one zero-day.

Among the 34 vulnerabilities patched, there were 4 Critical severity vulnerabilities and 30 were termed as Important by Microsoft.

There were 5 Spoofing vulnerabilities, 5 Denial of Service vulnerabilities, 6 Information Disclosure vulnerabilities, 8 Remote code execution vulnerabilities, and 10 Elevation of Privilege vulnerabilities.

However, 3 RCEs and 1 Spoofing vulnerability were marked as Critical by Microsoft.

Zero-Day Fixed 

CVE-2023-20588: Division-by-zero error on AMD processors

This was a non-Microsoft vulnerability that existed in AMD processors. Threat actors can exploit this vulnerability and potentially retrieve sensitive data that can be used for malicious purposes. The severity for this vulnerability was given as 5.5 (Medium). 

This vulnerability was known to be reported to AMD in August 2023, but the company only provided mitigation steps instead of patching this. However, Microsoft has acted upon this and released patches to fix this vulnerability.

Critical Vulnerabilities

According to the updates from Microsoft, four of the critical severity vulnerabilities were CVE-2023-35630 (Remote Code Execution), CVE-2023-35628 (Remote Code Execution), CVE-2023-35641 (Remote Code Execution), and CVE-2023-36019 (Spoofing).

The RCEs existed in several Microsoft products, including Microsoft Windows Server (2012, 2008, 2016, 2019, 2022), Windows 10, Windows 11, and others.

The spoofing vulnerability existed in two of Microsoft’s products: Azure Logic Apps and Microsoft Power Platform. 

As for the Remote Code execution vulnerabilities, the other 5 were marked as “Important” by Microsoft. Microsoft has released security patches for all the affected Microsoft Products.

A complete list of patches and vulnerabilities has been released by Microsoft, which provides detailed information about the products that were affected and their patched versions. 

Users of these Microsoft products are recommended to upgrade to the latest versions to prevent threat actors from exploiting these vulnerabilities.

Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

New Zhong Stealer Malware Exploit Zendesk to Attack Fintech and Cryptocurrency

A newly identified malware, dubbed Zhong Stealer, has emerged as a significant threat to...

SPAWNCHIMERA Malware Exploits Ivanti Buffer Overflow Vulnerability by Applying a Critical Fix

In a recent development, the SPAWNCHIMERA malware family has been identified exploiting the buffer...

Sitevision Auto-Generated Password Vulnerability Lets Hackers Steal Signing Key

A significant vulnerability in Sitevision CMS, versions 10.3.1 and earlier, has been identified, allowing...

NSA Allegedly Hacked Northwestern Polytechnical University, China Claims

Chinese cybersecurity entities have accused the U.S. National Security Agency (NSA) of orchestrating a...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

New Zhong Stealer Malware Exploit Zendesk to Attack Fintech and Cryptocurrency

A newly identified malware, dubbed Zhong Stealer, has emerged as a significant threat to...

SPAWNCHIMERA Malware Exploits Ivanti Buffer Overflow Vulnerability by Applying a Critical Fix

In a recent development, the SPAWNCHIMERA malware family has been identified exploiting the buffer...

Sitevision Auto-Generated Password Vulnerability Lets Hackers Steal Signing Key

A significant vulnerability in Sitevision CMS, versions 10.3.1 and earlier, has been identified, allowing...