Vulnerabilitycritical

Microsoft fixes wormable RCE in Windows Server and Windows (CVE-2022-21907)

Help Net Securityby @zeljkazorzJan 11, 2022 · 00:00 UTC (Jan 11, 2022)3 min read1 · 1 read

Read at helpnetsecurity.com

Analyze CVE-2022-21907 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2022-21907 CVE-2021-22947 CVE-2021-36976 CVE-2022-21846 CVE-2022-21840 CVE-2022-21857 CVE-2022-21893

Tags: cve-2022-21907 cve-2021-22947 cve-2021-36976 cve-2022-21846 cve-2022-21840 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-22947	When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and…	5.9	3%	PoC	Sep 29, 2021
CVE-2021-36976	libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block)	6.5	3%		Jul 20, 2021
CVE-2022-21840	Microsoft Office Remote Code Execution Vulnerability	8.8	3%		Jan 11, 2022
CVE-2022-21846	Microsoft Exchange Server Remote Code Execution Vulnerability	9.0	1%		Jan 11, 2022
CVE-2022-21907 +2 related CVEs CVE-2022-21857 CVE-2022-21893	HTTP Protocol Stack Remote Code Execution Vulnerability	9.8 group max	93%		Jan 11, 2022

From the original article

3 min read at helpnetsecurity.com

The first Patch Tuesday of 2022 is upon us, and Microsoft has delivered patches for 96 CVE-numbered vulnerabilities, including a wormable RCE flaw in Windows Server (CVE-2022-21907).

Help Net Security

By @zeljkazorz · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.