Microsoft December 2021 Patch Tuesday fixes an actively exploited zero
- CVEs
- CVE-2021-43890CVE-2021-43240CVE-2021-41333CVE-2021-43880CVE-2021-43883CVE-2021-43893CVE-2021-43215CVE-2021-43899CVE-2021-42310CVE-2021-43905CVE-2021-43233CVE-2021-43907CVE-2021-43217CVE-2021-43877CVE-2021-43225CVE-2021-43219CVE-2021-40452CVE-2021-40453CVE-2021-41360CVE-2021-43892CVE-2021-42312CVE-2021-43888CVE-2021-41365CVE-2021-42311CVE-2021-42313CVE-2021-42314CVE-2021-42315CVE-2021-43882CVE-2021-43889CVE-2021-43256CVE-2021-42293CVE-2021-43216CVE-2021-43222CVE-2021-43236CVE-2021-43875CVE-2021-43255CVE-2021-43896CVE-2021-42294CVE-2021-42309CVE-2021-42320CVE-2021-43242CVE-2021-43227CVE-2021-43235CVE-2021-43228CVE-2021-42295CVE-2021-43891CVE-2021-43908CVE-2021-43243CVE-2021-43214CVE-2021-43207CVE-2021-43226CVE-2021-43224CVE-2021-43248CVE-2021-43245CVE-2021-43232CVE-2021-43234CVE-2021-43246
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2021-40452+2 related CVEs | HEVC Video Extensions Remote Code Execution Vulnerability | 7.8 | 3% | ||
| CVE-2021-43217 | Windows Encrypting File System (EFS) Remote Code Execution Vulnerability | 9.8 group max | 6% | ||
| CVE-2021-42311 | Microsoft Defender for IoT Remote Code Execution Vulnerability | 10.0 group max | 4% | PoC | |
CVE-2021-43875+4 related CVEs | Microsoft Office Graphics Remote Code Execution Vulnerability | 7.8 group max | 5% | ||
CVE-2021-42309+3 related CVEs | Microsoft SharePoint Server Remote Code Execution Vulnerability | 8.8 group max | 3% | ||
| CVE-2021-43214 | Web Media Extensions Remote Code Execution Vulnerability | 9.8 | 2% | ||
| CVE-2021-43225 | Bot Framework SDK Remote Code Execution Vulnerability | 9.8 | 3% | ||
CVE-2021-43226+1 related CVE | Local Privilege Escalation in Microsoft Windows CLFS Driver (CVE-2021-43226) | 7.8 group max | 3% | KEVRansomware | KEV |
| CVE-2021-43243 | VP9 Video Extensions Information Disclosure Vulnerability | 5.5 | <1% | ||
| CVE-2021-43245 | Windows Digital TV Tuner Elevation of Privilege Vulnerability | 7.8 | <1% | ||
| CVE-2021-43877 | ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability | 8.8 | <1% | ||
| CVE-2021-43880 | Windows Mobile Device Management Elevation of Privilege Vulnerability | 5.5 | <1% | ||
CVE-2021-43891+1 related CVE | Visual Studio Code Remote Code Execution Vulnerability | 7.8 group max | 13% | ||
| CVE-2021-43892 | Microsoft BizTalk ESB Toolkit Spoofing Vulnerability | 7.4 | 3% | ||
| CVE-2021-43896 | Microsoft PowerShell Spoofing Vulnerability | 5.5 | 2% | ||
| CVE-2021-43899 | Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability | 9.8 | 2% | ||
| CVE-2021-43905 | Microsoft Office app Remote Code Execution Vulnerability | 9.6 | 3% | ||
| CVE-2021-43907 | Visual Studio Code WSL Extension Remote Code Execution Vulnerability | 9.8 | 4% |
From the original article
6 min read at securityaffairs.com
Microsoft December 2021 Patch Tuesday addresses 67 vulnerabilities, including an actively exploited Windows Installer vulnerability. Microsoft December 2021 Patch Tuesday addressed 67 vulnerabilities in Microsoft Windows and Windows Components, ASP.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.