{"id":23651,"date":"2024-01-13T12:29:03","date_gmt":"2024-01-13T20:29:03","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2024\/01\/13\/news-17381\/"},"modified":"2024-01-13T12:29:03","modified_gmt":"2024-01-13T20:29:03","slug":"news-17381","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2024\/01\/13\/news-17381\/","title":{"rendered":"2024\u2019s first Patch Tuesday steps lightly"},"content":{"rendered":"

Credit to Author: Angela Gunn| Date: Tue, 09 Jan 2024 22:03:14 +0000<\/strong><\/p>\n

\n

January isn\u2019t traditionally the lightest month on patch managers\u2019 calendars, so a second month of (relatively) few Microsoft releases is a bit of a treat. On Tuesday the company released 48 CVEs, including 38 for Windows. Eight other product groups or tools are also affected. Of the CVEs addressed, just two are considered Critical in severity by Microsoft; both affect Windows.<\/p>\n

At patch time, none of the issues are known to be under exploit in the wild, and none have been publicly disclosed. However, nine of the addressed vulnerabilities in Windows and SharePoint (including one of the Critical-severity CVEs, affecting Kerberos) are by the company\u2019s estimation more likely to be exploited in the next 30 days. Four of those are amenable to detection by Sophos protections, and we include information on those in a table below.<\/p>\n

In addition to the 48 patches the release included information on four Chrome CVEs (released last week) that affect Edge, and one MITRE-issued CVE touching the open-source database engine SQLite. (There are no Adobe offerings this month.) We don\u2019t include those issues in the CVE counts and graphics below, but we provide information on everything in an appendix at the end of the article. We are as usual including at the end of this post three other appendices listing all Microsoft\u2019s patches, sorted by severity, by predicted exploitability, and by product family.<\/p>\n

By the numbers<\/h3>\n