Microsoft Patch Tuesday for June 2023 fixes 6 critical flaws
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-29363 +1 in the same advisory: …32014 | Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability NVD description · AI analysis pending | 9.8 | 2% |
| — | ||
| CVE-2023-3079 | Type Confusion in Google Chromium V8 Engine Exploited in the Wild CVE-2023-3079 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine that powers Google Chromium, triggerable remotely when a user visits or is directed to a specially crafted HTML page. Successful exploitation causes heap corruption, which a remote attacker can leverage to execute code within the affected browser's renderer process. Every browser or application built on the Chromium engine is potentially affected, explicitly including Google Chrome, Microsoft Edge, and Opera. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-06-07 with a required action to apply vendor updates, and EPSS assigns a 32.1% probability of exploitation activity in the next 30 days (98th percentile). No public proof-of-concept code is known, but the KEV listing confirms real-world attacks, making rapid patching of all Chromium-based browsers a priority. Do: Immediately update Google Chrome, Microsoft Edge, Opera, and any other Chromium-based browsers (including Chromium-embedded applications) to the latest vendor release, per the CISA KEV required action to apply updates per vendor instructions; confirm the update applied via the browser's About/Settings page. As a stopgap where patching is delayed, restrict browsing to trusted sites or disable JavaScript where feasible, since exploitation requires the renderer to process a crafted HTML page. | 8.8 | 32% | KEV PoC |
| mass3+ billion users (Chrome's global install base alone; Chromium-based Edge and Opera add hundreds of millions more) | |
| CVE-2023-32021 | Windows SMB Witness Service Security Feature Bypass Vulnerability Windows SMB Witness Service Security Feature Bypass Vulnerability NVD description · AI analysis pending | 7.1 | 1% |
| — |
Full article340 words · extracted from securityaffairs.com · click to collapse
Microsoft Patch Tuesday security updates for June 2023 fixed 69 flaws in its products, including six critical issues.
Microsoft Patch Tuesday security updates for June 2023 fixed 69 vulnerabilities in multiple products, including Microsoft Windows and Windows Components; Office and Office Components; Exchange Server; Microsoft Edge (Chromium-based); SharePoint Server; .NET and Visual Studio; Microsoft Teams; Azure DevOps; Microsoft Dynamics; and the Remote Desktop Client.
Six out of 69 vulnerabilities addressed by Microsoft are rated Critical, 62 are rated Important, and one is rated Moderate in severity. None of the vulnerabilities have been publicly known or exploited in the wild.
Five of these vulnerabilities were submitted through the ZDI program.
Below are the descriptions of some of the most interesting issues addressed by Microsoft:
CVE-2023-29363, CVE-2023-32014 and CVE-2023-32015 (CVSS 9.8) – Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerabilities.
A remote, unauthenticated attacker can trigger these vulnerabilities to execute arbitrary code on a vulnerable system where the message queuing service is running in a Pragmatic General Multicast (PGM) Server environment. Pragmatic General Multicast (PGM) is a reliable multicast computer network transport protocol. It is important to highlight that PGM is not enabled by default.
CVE-2023-32021 (CVSS 7.1) – Microsoft Exchange Server Remote Code Execution Vulnerability.
The issue is a remote code execution bug in Microsoft Exchange Server that can be exploited by an attacker to bypass issues that were previously exploited in the wild. A remote attacker can exploit this flaw to execute arbitrary code with SYSTEM privileges.
CVE-2023-3079 – Chromium: CVE-2023-3079 Type Confusion in V8
This vulnerability is a type confusion bug in Chrome that could lead to code execution at the level of the logged-on user. This flaw was first discovered by the Chrome team on June 1 and is actively exploited in malware attacks.
The full list of vulnerabilities fixed by Microsoft with the release of Patch Tuesday security updates for June 2023 is available here.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Patch Tuesday)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/147452/security/microsoft-patch-tuesday-june-2023.html