The world’s largest software maker Microsoft on Tuesday released patches with cover for at least 59 documented security vulnerabilities, including a pair of critical-severity zero-days already being exploited in the wild.
Redmond’s security response team documented a wide range of security defects in a range of Windows OS and components and called special attention to two vulnerabilities — CVE-2023-36033 and CVE-2023-36036 being exploited in active attacks.
“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” Microsoft said two separate advisories that credit security researcher Quan Jin, DBAPPSecurity WeBin Lab and its own threat-intel teams for discovering the two zero-days.
As is customary, Microsoft’s barebones bulletins did not contain any details on the live attacks or indicators of compromise to help defenders hunt for signs of infections.
The Patch Tuesday rollout also fixes the known — and already exploited — WepP flaw affecting its Microsoft Edge (Chromium-based browser) and remote code execution issues in the Windows cURL Implementation.
Microsoft also pushed out another patch to address feature bypass issues that continue to haunt its Windows SmartScreen tool and major updates to fix remote code execution and privilege escalation issues in Windows Pragmatic General Multicast (PGM) and Windows HMAC Key Derivation components.
The PGM flaw (CVE-2023-36397) carries a CVSS severity score of 9.8 out of 10 and should be considered a patch for high-priority deployment.
Microsoft’s patches follow Adobe’s rollout of a massive batch of security fixes to cover critical-severity flaws in its Acrobat and Reader, ColdFusion, inDesign, inCopy and Audition products.
Adobe documented 72 distinct security bugs and called special attention to code-execution defects in the widely deployed Adobe Acrobat and Reader software.
In a critical-severity bulletin, Adobe documented at least 17 Acrobat and Reader bugs that expose unpatched Windows and macOS systems to arbitrary code execution and memory leak issues.
Adobe also issued patches for at least six distinct ColdFusion flaws that could lead to arbitrary code execution and security feature bypass. The ColdFusion issues are flagged as critical and affects versions 2023 and 2021.
Related: Two New Adobe ColdFusion Vulnerabilities Exploited in Attacks
Related: Microsoft Plugs Windows Hole Exploited in Ransomware Attacks
Related: Google Patches Chrome Zero-Day Reported by Spyware Hunters
Related: Patch Tuesday: Microsoft Warns of Exploited Windows Zero-Days
Related: Microsoft (Finally) Patches Exploited Office Zero-Days
https://www.securityweek.com/microsoft-warns-of-critical-bugs-being-exploited-in-the-wild/