Microsoft has released their patches for December 2023 as part of their Patch Tuesday. In this release, they have patched more than 34 vulnerabilities and one zero-day.
Among the 34 vulnerabilities patched, there were 4 Critical severity vulnerabilities and 30 were termed as Important by Microsoft.
There were 5 Spoofing vulnerabilities, 5 Denial of Service vulnerabilities, 6 Information Disclosure vulnerabilities, 8 Remote code execution vulnerabilities, and 10 Elevation of Privilege vulnerabilities.
However, 3 RCEs and 1 Spoofing vulnerability were marked as Critical by Microsoft.
This was a non-Microsoft vulnerability that existed in AMD processors. Threat actors can exploit this vulnerability and potentially retrieve sensitive data that can be used for malicious purposes. The severity for this vulnerability was given as 5.5 (Medium).
This vulnerability was known to be reported to AMD in August 2023, but the company only provided mitigation steps instead of patching this. However, Microsoft has acted upon this and released patches to fix this vulnerability.
According to the updates from Microsoft, four of the critical severity vulnerabilities were CVE-2023-35630 (Remote Code Execution), CVE-2023-35628 (Remote Code Execution), CVE-2023-35641 (Remote Code Execution), and CVE-2023-36019 (Spoofing).
The RCEs existed in several Microsoft products, including Microsoft Windows Server (2012, 2008, 2016, 2019, 2022), Windows 10, Windows 11, and others.
The spoofing vulnerability existed in two of Microsoft’s products: Azure Logic Apps and Microsoft Power Platform.
As for the Remote Code execution vulnerabilities, the other 5 were marked as “Important” by Microsoft. Microsoft has released security patches for all the affected Microsoft Products.
A complete list of patches and vulnerabilities has been released by Microsoft, which provides detailed information about the products that were affected and their patched versions.
Users of these Microsoft products are recommended to upgrade to the latest versions to prevent threat actors from exploiting these vulnerabilities.
Hackers prefer phishing as it exploits human vulnerabilities rather than technical flaws which make it a highly effective and low-cost…
A very important message from the Norwegian National Cyber Security Centre (NCSC) says that Secure Socket Layer/Transport Layer Security (SSL/TLS)…
Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices, which makes it an attractive target…
ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine, to target infected systems, which extracts…
Santander has confirmed that there was a major data breach that affected its workers and customers in Spain, Uruguay, and…
The U.S. government has offered a prize of up to $5 million for information that leads to the arrest and…