{"id":23584,"date":"2023-12-12T15:21:05","date_gmt":"2023-12-12T23:21:05","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2023\/12\/12\/news-17314\/"},"modified":"2023-12-12T15:21:05","modified_gmt":"2023-12-12T23:21:05","slug":"news-17314","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2023\/12\/12\/news-17314\/","title":{"rendered":"From Microsoft to you, 33 packages"},"content":{"rendered":"

Credit to Author: Angela Gunn| Date: Tue, 12 Dec 2023 22:12:08 +0000<\/strong><\/p>\n

\n

Microsoft on Tuesday released patches for 33 vulnerabilities, including 24 for Windows. Five other product groups are also affected. Of the CVEs addressed, just four are considered Critical in severity \u2013 at least by Microsoft. (More on that in a second.) Three of Microsoft\u2019s Critical-severity patches affect Windows, while the other one affects both Azure and Microsoft Power Platform Connector. (Connectors are proxies or wrappers around APIs that allow the underlying services to connect to each other; Microsoft has a very large ecosystem of these integration tools.)<\/p>\n

At patch time, none of the issues are known to be under exploit in the wild, and none have been publicly disclosed. However, fully a third of the addressed vulnerabilities in Windows and Defender \u2013 11 CVEs — are by the company\u2019s estimation more likely to be exploited in the next 30 days.<\/p>\n

In addition to those CVEs, Microsoft lists one official advisory, ADV990001, which covers their latest servicing stack updates. However, Edge-related issues, which are not tallied in the official count, make a strong showing this month with nine CVEs. Seven of those, including five coming to Edge through the Chromium project, were released on December 7. Of the other two released today, one elevation-of-privilege vulnerability (CVE-2023-35618) has the peculiar quality of being a mere moderate-severity issue in Microsoft\u2019s estimation, but worth a critical-class 9.6 CVSS base score. The issue requires a sandbox escape to function, and Microsoft assesses it as less likely to be exploited within the next 30 days, but we do recommend keeping Edge and other Chromium-based browsers up to date.<\/p>\n

We don\u2019t include Edge issues in the CVE counts and graphics below, but we\u2019ll provide information on everything in an appendix at the end of the article. We are as usual including at the end of this post three other appendices listing all Microsoft\u2019s patches, sorted by severity, by predicted exploitability, and by product family.<\/p>\n

By the numbers<\/strong><\/p>\n