Microsoft March 2022 Patch Tuesday updates fix 89 vulnerabilities
criticalVulnerability exploited in the wildimportance 60CVE-2022-21990CVE-2022-24459CVE-2022-24512CVE-2022-24464CVE-2020-8927CVE-2022-24506CVE-2022-24517CVE-2022-24470CVE-2022-24471CVE-2022-24520CVE-2022-24518CVE-2022-24519CVE-2022-24515CVE-2022-24467CVE-2022-24468CVE-2022-24469CVE-2022-23278CVE-2022-23265CVE-2022-23266CVE-2022-0790CVE-2022-0789CVE-2022-0809CVE-2022-0791CVE-2022-0803CVE-2022-0804CVE-2022-0801CVE-2022-0802CVE-2022-0807CVE-2022-0808CVE-2022-0805CVE-2022-0806CVE-2022-0800CVE-2022-0794CVE-2022-0795CVE-2022-0792CVE-2022-0793CVE-2022-0796CVE-2022-0798CVE-2022-0797CVE-2022-0799CVE-2022-23277CVE-2022-24463CVE-2022-24465CVE-2022-24510CVE-2022-24509CVE-2022-24461CVE-2022-24462CVE-2022-24511CVE-2022-23287CVE-2022-24505CVE-2022-23283CVE-2022-24451CVE-2022-22007CVE-2022-22006CVE-2022-24452CVE-2022-24453CVE-2022-24501CVE-2022-24457CVE-2022-24456CVE-2022-22010CVE-2022-21977CVE-2022-23295CVE-2022-23300CVE-2022-23301CVE-2022-23282CVE-2022-21975CVE-2022-24522
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-8927 | A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits. NVD description · AI analysis pending | 6.5 | 3% |
| — | ||
| CVE-2022-0790 | Use after free in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to potent Use after free in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially perform a sandbox escape via a crafted HTML page. NVD description · AI analysis pending | 9.6 group max | <1% |
| — | ||
| CVE-2022-0801 | Inappropriate implementation in HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS preventions via a crafted HTML page. Inappropriate implementation in HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS preventions via a crafted HTML page. (Chrome security severity: Medium) NVD description · AI analysis pending | 6.1 | <1% |
| — | ||
| CVE-2022-21990 | Remote Desktop Client Remote Code Execution Vulnerability Remote Desktop Client Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.8 group max | 19% |
| — | ||
| CVE-2022-22006 | HEVC Video Extensions Remote Code Execution Vulnerability HEVC Video Extensions Remote Code Execution Vulnerability NVD description · AI analysis pending | 7.8 | 2% |
| — | ||
| CVE-2022-23266 +1 in the same advisory: …23265 | Microsoft Defender for IoT Elevation of Privilege Vulnerability Microsoft Defender for IoT Elevation of Privilege Vulnerability NVD description · AI analysis pending | 7.8 group max | 1% |
| — | ||
| CVE-2022-23277 +1 in the same advisory: …24463 | Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.8 group max | 42% |
| — | ||
| CVE-2022-23278 | Microsoft Defender for Endpoint Spoofing Vulnerability Microsoft Defender for Endpoint Spoofing Vulnerability NVD description · AI analysis pending | 5.9 | 2% |
| — | ||
| CVE-2022-23282 | Paint 3D Remote Code Execution Vulnerability Paint 3D Remote Code Execution Vulnerability NVD description · AI analysis pending | 7.8 | 2% |
| — | ||
| CVE-2022-23295 +1 in the same advisory: …23300 | Raw Image Extension Remote Code Execution Vulnerability Raw Image Extension Remote Code Execution Vulnerability NVD description · AI analysis pending | 7.8 | 2% |
| — | ||
| CVE-2022-24501 +1 in the same advisory: …24451 | VP9 Video Extensions Remote Code Execution Vulnerability VP9 Video Extensions Remote Code Execution Vulnerability NVD description · AI analysis pending | 7.8 | 3% |
| — | ||
| CVE-2022-24457 | HEIF Image Extensions Remote Code Execution Vulnerability HEIF Image Extensions Remote Code Execution Vulnerability NVD description · AI analysis pending | 7.8 | 2% |
| — | ||
| CVE-2022-24461 | Microsoft Office Visio Remote Code Execution Vulnerability Microsoft Office Visio Remote Code Execution Vulnerability NVD description · AI analysis pending | 7.8 group max | 3% |
| — | ||
| CVE-2022-24464 +1 in the same advisory: …24512 | .NET and Visual Studio Denial of Service Vulnerability .NET and Visual Studio Denial of Service Vulnerability NVD description · AI analysis pending | 7.5 group max | 4% |
| — | ||
| CVE-2022-24465 | Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability NVD description · AI analysis pending | 3.3 | <1% |
| — | ||
| CVE-2022-24469 | Azure Site Recovery Elevation of Privilege Vulnerability Azure Site Recovery Elevation of Privilege Vulnerability NVD description · AI analysis pending | 8.1 group max | 3% |
| — | ||
| CVE-2022-24522 | Skype Extension for Chrome Information Disclosure Vulnerability Skype Extension for Chrome Information Disclosure Vulnerability NVD description · AI analysis pending | 6.5 | 2% |
| — |
Full article1,284 words · extracted from securityaffairs.com · click to collapse
Microsoft March 2022 Patch Tuesday security updates address 89 vulnerabilities in multiple products, including Microsoft Windows components, Azure and Azure DevOps, Azure Sphere, Internet Explorer and Edge (EdgeHTML), Exchange Server, Office and Office Services and Web Apps, SharePoint Server, Visual Studio, and Windows Hyper-V.
The update includes fixes for 7 flaws in MS Exchange and 21 Microsoft Edge vulnerabilities. 14 vulnerabilities have been rated as Critical and 75 are listed as Important in severity. Two of these vulnerabilities are listed as publicly known while five are actively exploited.
Three flaws addressed by the Microsoft March 2022 Patch Tuesday security updates are zero-day issues, and for two of them, CVE-2022-21990 and CVE-2022-24459, public exploits are available.
None of the above zero-day have been exploited in attacks.
| Tag | CVE ID | CVE Title | Severity |
|---|---|---|---|
| .NET and Visual Studio | CVE-2022-24512 | .NET and Visual Studio Remote Code Execution Vulnerability | Important |
| .NET and Visual Studio | CVE-2022-24464 | .NET and Visual Studio Denial of Service Vulnerability | Important |
| .NET and Visual Studio | CVE-2020-8927 | Brotli Library Buffer Overflow Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24506 | Azure Site Recovery Elevation of Privilege Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24517 | Azure Site Recovery Remote Code Execution Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24470 | Azure Site Recovery Remote Code Execution Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24471 | Azure Site Recovery Remote Code Execution Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24520 | Azure Site Recovery Remote Code Execution Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24518 | Azure Site Recovery Elevation of Privilege Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24519 | Azure Site Recovery Elevation of Privilege Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24515 | Azure Site Recovery Elevation of Privilege Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24467 | Azure Site Recovery Remote Code Execution Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24468 | Azure Site Recovery Remote Code Execution Vulnerability | Important |
| Azure Site Recovery | CVE-2022-24469 | Azure Site Recovery Elevation of Privilege Vulnerability | Important |
| Microsoft Defender for Endpoint | CVE-2022-23278 | Microsoft Defender for Endpoint Spoofing Vulnerability | Important |
| Microsoft Defender for IoT | CVE-2022-23265 | Microsoft Defender for IoT Remote Code Execution Vulnerability | Important |
| Microsoft Defender for IoT | CVE-2022-23266 | Microsoft Defender for IoT Elevation of Privilege Vulnerability | Important |
| Microsoft Edge (Chromium-based) | CVE-2022-0790 | Chromium: CVE-2022-0790 Use after free in Cast UI | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0789 | Chromium: CVE-2022-0789 Heap buffer overflow in ANGLE | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0809 | Chromium: CVE-2022-0809 Out of bounds memory access in WebXR | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0791 | Chromium: CVE-2022-0791 Use after free in Omnibox | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0803 | Chromium: CVE-2022-0803 Inappropriate implementation in Permissions | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0804 | Chromium: CVE-2022-0804 Inappropriate implementation in Full screen mode | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0801 | Chromium: CVE-2022-0801 Inappropriate implementation in HTML parser | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0802 | Chromium: CVE-2022-0802 Inappropriate implementation in Full screen mode | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0807 | Chromium: CVE-2022-0807 Inappropriate implementation in Autofill | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0808 | Chromium: CVE-2022-0808 Use after free in Chrome OS Shell | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0805 | Chromium: CVE-2022-0805 Use after free in Browser Switcher | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0806 | Chromium: CVE-2022-0806 Data leak in Canvas | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0800 | Chromium: CVE-2022-0800 Heap buffer overflow in Cast UI | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0794 | Chromium: CVE-2022-0794 Use after free in WebShare | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0795 | Chromium: CVE-2022-0795 Type Confusion in Blink Layout | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0792 | Chromium: CVE-2022-0792 Out of bounds read in ANGLE | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0793 | Chromium: CVE-2022-0793 Use after free in Views | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0796 | Chromium: CVE-2022-0796 Use after free in Media | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0798 | Chromium: CVE-2022-0798 Use after free in MediaStream | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0797 | Chromium: CVE-2022-0797 Out of bounds memory access in Mojo | Unknown |
| Microsoft Edge (Chromium-based) | CVE-2022-0799 | Chromium: CVE-2022-0799 Insufficient policy enforcement in Installer | Unknown |
| Microsoft Exchange Server | CVE-2022-23277 | Microsoft Exchange Server Remote Code Execution Vulnerability | Critical |
| Microsoft Exchange Server | CVE-2022-24463 | Microsoft Exchange Server Spoofing Vulnerability | Important |
| Microsoft Intune | CVE-2022-24465 | Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability | Important |
| Microsoft Office Visio | CVE-2022-24510 | Microsoft Office Visio Remote Code Execution Vulnerability | Important |
| Microsoft Office Visio | CVE-2022-24509 | Microsoft Office Visio Remote Code Execution Vulnerability | Important |
| Microsoft Office Visio | CVE-2022-24461 | Microsoft Office Visio Remote Code Execution Vulnerability | Important |
| Microsoft Office Word | CVE-2022-24462 | Microsoft Word Security Feature Bypass Vulnerability | Important |
| Microsoft Office Word | CVE-2022-24511 | Microsoft Office Word Tampering Vulnerability | Important |
| Microsoft Windows ALPC | CVE-2022-23287 | Windows ALPC Elevation of Privilege Vulnerability | Important |
| Microsoft Windows ALPC | CVE-2022-24505 | Windows ALPC Elevation of Privilege Vulnerability | Important |
| Microsoft Windows ALPC | CVE-2022-23283 | Windows ALPC Elevation of Privilege Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-24451 | VP9 Video Extensions Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-22007 | HEVC Video Extensions Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-22006 | HEVC Video Extensions Remote Code Execution Vulnerability | Critical |
| Microsoft Windows Codecs Library | CVE-2022-24452 | HEVC Video Extensions Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-24453 | HEVC Video Extensions Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-24501 | VP9 Video Extensions Remote Code Execution Vulnerability | Critical |
| Microsoft Windows Codecs Library | CVE-2022-24457 | HEIF Image Extensions Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-24456 | HEVC Video Extensions Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-22010 | Media Foundation Information Disclosure Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-21977 | Media Foundation Information Disclosure Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-23295 | Raw Image Extension Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-23300 | Raw Image Extension Remote Code Execution Vulnerability | Important |
| Microsoft Windows Codecs Library | CVE-2022-23301 | HEVC Video Extensions Remote Code Execution Vulnerability | Important |
| Paint 3D | CVE-2022-23282 | Paint 3D Remote Code Execution Vulnerability | Important |
| Role: Windows Hyper-V | CVE-2022-21975 | Windows Hyper-V Denial of Service Vulnerability | Important |
| Skype Extension for Chrome | CVE-2022-24522 | Skype Extension for Chrome Information Disclosure Vulnerability | Important |
| Tablet Windows User Interface | CVE-2022-24460 | Tablet Windows User Interface Application Elevation of Privilege Vulnerability | Important |
| Visual Studio Code | CVE-2022-24526 | Visual Studio Code Spoofing Vulnerability | Important |
| Windows Ancillary Function Driver for WinSock | CVE-2022-24507 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important |
| Windows CD-ROM Driver | CVE-2022-24455 | Windows CD-ROM Driver Elevation of Privilege Vulnerability | Important |
| Windows Cloud Files Mini Filter Driver | CVE-2022-23286 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | Important |
| Windows COM | CVE-2022-23290 | Windows Inking COM Elevation of Privilege Vulnerability | Important |
| Windows Common Log File System Driver | CVE-2022-23281 | Windows Common Log File System Driver Information Disclosure Vulnerability | Important |
| Windows DWM Core Library | CVE-2022-23291 | Windows DWM Core Library Elevation of Privilege Vulnerability | Important |
| Windows DWM Core Library | CVE-2022-23288 | Windows DWM Core Library Elevation of Privilege Vulnerability | Important |
| Windows Event Tracing | CVE-2022-23294 | Windows Event Tracing Remote Code Execution Vulnerability | Important |
| Windows Fastfat Driver | CVE-2022-23293 | Windows Fast FAT File System Driver Elevation of Privilege Vulnerability | Important |
| Windows Fax and Scan Service | CVE-2022-24459 | Windows Fax and Scan Service Elevation of Privilege Vulnerability | Important |
| Windows HTML Platform | CVE-2022-24502 | Windows HTML Platforms Security Feature Bypass Vulnerability | Important |
| Windows Installer | CVE-2022-23296 | Windows Installer Elevation of Privilege Vulnerability | Important |
| Windows Kernel | CVE-2022-23297 | Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability | Important |
| Windows Kernel | CVE-2022-23298 | Windows NT OS Kernel Elevation of Privilege Vulnerability | Important |
| Windows Media | CVE-2022-21973 | Windows Media Center Update Denial of Service Vulnerability | Important |
| Windows PDEV | CVE-2022-23299 | Windows PDEV Elevation of Privilege Vulnerability | Important |
| Windows Point-to-Point Tunneling Protocol | CVE-2022-23253 | Point-to-Point Tunneling Protocol Denial of Service Vulnerability | Important |
| Windows Print Spooler Components | CVE-2022-23284 | Windows Print Spooler Elevation of Privilege Vulnerability | Important |
| Windows Remote Desktop | CVE-2022-21990 | Remote Desktop Client Remote Code Execution Vulnerability | Important |
| Windows Remote Desktop | CVE-2022-23285 | Remote Desktop Client Remote Code Execution Vulnerability | Important |
| Windows Remote Desktop | CVE-2022-24503 | Remote Desktop Protocol Client Information Disclosure Vulnerability | Important |
| Windows Security Support Provider Interface | CVE-2022-24454 | Windows Security Support Provider Interface Elevation of Privilege Vulnerability | Important |
| Windows SMB Server | CVE-2022-24508 | Windows SMBv3 Client/Server Remote Code Execution Vulnerability | Important |
| Windows Update Stack | CVE-2022-24525 | Windows Update Stack Elevation of Privilege Vulnerability | Important |
| XBox | CVE-2022-21967 | Xbox Live Auth Manager for Windows Elevation of Privilege Vulnerability | Important |
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/128834/security/microsoft-march-2022-patch-tuesday.html