October 2020 Patch Tuesday: Microsoft fixes potentially wormable Windows TCP/IP RCE flaw
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-12352 | Improper access control in BlueZ may allow an unauthenticated user to potentially enable information disclosure via adjacent access | 6.5 | 6% | PoC | |
CVE-2020-16898+1 related CVE | A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets | 8.8 group max | 11% | ||
| CVE-2020-16947 | A remote code execution vulnerability exists in Microsoft Outlook software when the software fails to properly handle objects in memory | 7.5 | 34% | ||
CVE-2020-16952+1 related CVE | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package | 8.6 | 71% | PoC | |
| CVE-2020-24490 | Improper buffer restrictions in BlueZ may allow an unauthenticated user to potentially enable denial of service via adjacent access | 6.5 | 2% | ||
| CVE-2020-6364 | SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an attacker to modify a cookie in a way that… | 10.0 | 6% | ||
| CVE-2020-6369 | SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an unauthenticated attackers to bypass the… | 5.9 | 3% | ||
| CVE-2020-9746 | Adobe Flash Player version 32.0.0.433 (and earlier) are affected by an exploitable NULL pointer dereference vulnerability that could result in a crash and… | 8.8 | 4% |
From the original article
3 min read at helpnetsecurity.com
Microsoft has plugged 87 security holes, including critical ones in the Windows TCP/IP stack and Microsoft Outlook and Microsoft 365 Apps for Enterprise Intel warns about flaws in BlueZ, the official Linux Bluetooth protocol stack SAP has released 15 security notes and updates to 6 previously released ones.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.