October Patch Tuesday Addresses Three Zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-36563 | Information Disclosure in Microsoft WordPad Exploited in the Wild | 5.5 | 20% | KEV | KEV |
| CVE-2023-41763 | Unauthenticated SSRF/Elevation-of-Privilege Flaw in Microsoft Skype for Business Server | 5.3 | 91% | KEV | KEV |
| CVE-2023-41773 | Layer 2 Tunneling Protocol Remote Code Execution Vulnerability | 8.1 | 1% | ||
| CVE-2023-44487 | Rapid Reset Denial-of-Service in HTTP/2 (CWE-400 Resource Exhaustion) | 7.5 | 100% | KEV | KEV |
From the original article
2 min read at infosecurity-magazine.com
Microsoft has fixed three zero-day vulnerabilities in its latest security update round this month, all of which are being actively exploited in the wild. October’s Patch Tuesday fixed 104 vulnerabilities, only 12 of which were labelled “Critical.” All of these are remote code execution (RCE) bugs, although there are 45 such vulnerabilities listed in total this month.
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.