• Menu
  • Skip to main content
  • Skip to primary sidebar

The Cyber Security News

Latest Cyber Security News

Header Right

  • Latest News
  • Vulnerabilities
  • Cloud Services
alert: microsoft releases patch updates for 5 new zero day vulnerabilities

Alert: Microsoft Releases Patch Updates for 5 New Zero-Day Vulnerabilities

You are here: Home / General Cyber Security News / Alert: Microsoft Releases Patch Updates for 5 New Zero-Day Vulnerabilities
November 15, 2023

Microsoft has launched fixes to handle 63 security bugs in its application for the month of November 2023, like 3 vulnerabilities that have arrive underneath energetic exploitation in the wild.

Of the 63 flaws, 3 are rated Critical, 56 are rated Essential, and 4 are rated Reasonable in severity. Two of them have been outlined as publicly recognised at the time of the release.

The updates are in addition to much more than 35 security shortcomings dealt with in its Chromium-based mostly Edge browser due to the fact the launch of Patch Tuesday updates for Oct 2023.

✔ Approved Seller From Our Partners
Mullvad VPN Discount

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount


The five zero-days that are of note are as follows –

  • CVE-2023-36025 (CVSS score: 8.8) – Windows SmartScreen Security Attribute Bypass Vulnerability
  • CVE-2023-36033 (CVSS score: 7.8) – Windows DWM Core Library Elevation of Privilege Vulnerability
  • CVE-2023-36036 (CVSS score: 7.8) – Windows Cloud Documents Mini Filter Driver Elevation of Privilege Vulnerability
  • CVE-2023-36038 (CVSS rating: 8.2) – ASP.NET Main Denial of Service Vulnerability
  • CVE-2023-36413 (CVSS rating: 6.5) – Microsoft Workplace Security Attribute Bypass Vulnerability

Both of those CVE-2023-36033 and CVE-2023-36036 could be exploited by an attacker to obtain System privileges, when CVE-2023-36025 could make it achievable to bypass Windows Defender SmartScreen checks and their involved prompts.

Cybersecurity

“The user would have to click on on a specifically crafted Internet Shortcut (.URL) or a hyperlink pointing to an Internet Shortcut file to be compromised by the attacker,” Microsoft stated about CVE-2023-36025.

The Windows maker, nonetheless, has not delivered any further more direction on the attack mechanisms utilized and the menace actors that could be weaponizing them. But the active exploitation of the privilege escalation flaws implies that they are most likely utilized in conjunction with a distant code execution bug.

“There have been 12 elevation of privilege vulnerabilities in the DWM Core Library over the past two many years, while this is the initial to have been exploited in the wild as a zero-day,” Satnam Narang, senior personnel investigate engineer at Tenable, claimed in a assertion shared with The Hacker Information.

The progress has prompted the U.S. Cybersecurity and Infrastructure Security Company (CISA) to add the three issues to its Recognized Exploited Vulnerabilities (KEV) catalog, urging federal businesses to use the fixes by December 5, 2023.

Also patched by Microsoft are two critical distant code execution flaws in Safeguarded Extensible Authentication Protocol and Pragmatic Common Multicast (CVE-2023-36028 and CVE-2023-36397, CVSS scores: 9.8) that a menace actor could leverage to bring about the execution of malicious code.

The November update additional involves a patch for CVE-2023-38545 (CVSS rating: 9.8), a critical heap-primarily based buffer overflow flaw in the curl library that came to light-weight very last month, as very well as an info disclosure vulnerability in Azure CLI (CVE-2023-36052, CVSS rating: 8.6).

“An attacker that effectively exploited this vulnerability could get better plaintext passwords and usernames from log information developed by the influenced CLI instructions and published by Azure DevOps and/or GitHub Steps,” Microsoft explained.

Palo Alto Networks researcher Aviad Hahami, who noted the issue, mentioned the vulnerability could enable entry to qualifications stored in the pipeline’s log and permit an adversary to potentially escalate their privileges for stick to-on attacks.

Cybersecurity

In reaction, Microsoft explained it has made changes to quite a few Azure CLI instructions to harden Azure CLI (edition 2.54) towards inadvertent usage that could lead to secrets publicity.

Computer software Patches from Other Vendors

In addition to Microsoft, security updates have also been released by other vendors more than the past handful of months to rectify numerous vulnerabilities, including —

  • Adobe
  • AMD (like CacheWarp)
  • Android
  • Apache Tasks
  • Apple
  • Aruba Networks
  • Arm
  • ASUS
  • Atlassian
  • Cisco
  • CODESYS
  • Dell
  • Drupal
  • F5
  • Fortinet
  • GitLab
  • Google Chrome
  • Hitachi Vitality
  • HP
  • IBM
  • Intel
  • Jenkins
  • Juniper Networks
  • Lenovo
  • Linux distributions Debian, Oracle Linux, Red Hat, SUSE, and Ubuntu
  • MediaTek
  • Mitsubishi Electric powered
  • NETGEAR
  • NVIDIA
  • Palo Alto Networks
  • Qualcomm
  • Samsung
  • SAP
  • Schneider Electric powered
  • Siemens
  • SolarWinds
  • SonicWall
  • SysAid
  • Pattern Micro
  • Veeam
  • Veritas
  • VMware
  • WordPress
  • Zimbra
  • Zoom, and
  • Zyxel

Located this write-up exciting? Observe us on Twitter  and LinkedIn to go through a lot more unique content we article.


Some sections of this report are sourced from:
thehackernews.com

Previous Post: «urgent: vmware warns of unpatched critical cloud director vulnerability Urgent: VMware Warns of Unpatched Critical Cloud Director Vulnerability
Next Post: Reptar: New Intel CPU Vulnerability Impacts Multi-Tenant Virtualized Environments reptar: new intel cpu vulnerability impacts multi tenant virtualized environments»

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Primary Sidebar

Report This Article

Recent Posts

  • BREAKING: 7,000-Device Proxy Botnet Using IoT, EoL Systems Dismantled in U.S. – Dutch Operation
  • OtterCookie v4 Adds VM Detection and Chrome, MetaMask Credential Theft Capabilities
  • Initial Access Brokers Target Brazil Execs via NF-e Spam and Legit RMM Trials
  • Deploying AI Agents? Learn to Secure Them Before Hackers Strike Your Business
  • Malicious npm Packages Infect 3,200+ Cursor Users With Backdoor, Steal Credentials
  • Beyond Vulnerability Management – Can You CVE What I CVE?
  • Google Rolls Out On-Device AI Protections to Detect Scams in Chrome and Android
  • Chinese Hackers Exploit SAP RCE Flaw CVE-2025-31324, Deploy Golang-Based SuperShell
  • 38,000+ FreeDrain Subdomains Found Exploiting SEO to Steal Crypto Wallet Seed Phrases
  • SonicWall Patches 3 Flaws in SMA 100 Devices Allowing Attackers to Run Code as Root

Copyright © TheCyberSecurity.News, All Rights Reserved.