Microsoft October 2022 Patch Tuesday Fixes 84 Flaws, Including Zero-Day

Microsoft printed its October 2022 Patch Tuesday bulletin yesterday, which showcases fixes for an actively exploited Windows vulnerability together with 83 other flaws.

Of the 84 vulnerabilities fixed in yesterday’s update, 13 are labeled as ‘Critical’ as they alternatively or jointly allow for privilege elevation, spoofing or distant code execution. As for the others, 69 are rated Essential, and one particular is rated Reasonable.

More, this month’s Patch Tuesday fixed two zero-day vulnerabilities. The 1st zero-day is a Windows COM+ Celebration Procedure Services elevation of privilege vulnerability (CVSS score: 7.8), which affects an unknown perform of the part COM+ Celebration Method Support. 

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“This patch fixes a security vulnerability that Microsoft mentioned is below active attack. Even so, it is not clear how extreme these attacks are,” commented Saeed Abbasi, supervisor of vulnerability signatures at Qualys.

“Due to the mother nature of this vulnerability, a privilege escalation that often engages some social engineering (e.g., necessitating the user to open up a destructive attachment), record exhibits that it most likely wants to be chained with a code execution bug to exploit.”

The second zero-day, on the other hand, is a Microsoft Place of work Details Disclosure Vulnerability with a CVSS rating of 3.3/10.

Notably, Microsoft has not bundled a patch to the ProxyNotShell vulnerability in Trade Server (tracked CVE-2022-41040) after confirming its existence just about two months back.

“It’s worthy of noting that Microsoft has had to revise the mitigation for CVE-2022-41040 a lot more than the moment, as the suggested URL rewrite Mitigation was bypassed various occasions,” discussed Ankit Malhotra, supervisor of signature engineering at Qualys.

“Corporations that reacted to the ProxyShell vulnerability should also pay back near awareness to this, taking their lessons uncovered on quick remediation, as this vulnerability can potentially see amplified exploitation.”

Microsoft’s October 2022 Patch Tuesday report comes approximately a month soon after Apple unveiled an iOS 12 update for more mature iPhone and iPad products to patch a vulnerability that threat actors reportedly exploited.