Microsoft has released their patches for December 2023 as part of their Patch Tuesday. In this release, they have patched more than 34 vulnerabilities and one zero-day.
Among the 34 vulnerabilities patched, there were 4 Critical severity vulnerabilities and 30 were termed as Important by Microsoft.
There were 5 Spoofing vulnerabilities, 5 Denial of Service vulnerabilities, 6 Information Disclosure vulnerabilities, 8 Remote code execution vulnerabilities, and 10 Elevation of Privilege vulnerabilities.
However, 3 RCEs and 1 Spoofing vulnerability were marked as Critical by Microsoft.
Zero-Day Fixed
CVE-2023-20588: Division-by-zero error on AMD processors
This was a non-Microsoft vulnerability that existed in AMD processors. Threat actors can exploit this vulnerability and potentially retrieve sensitive data that can be used for malicious purposes. The severity for this vulnerability was given as 5.5 (Medium).
This vulnerability was known to be reported to AMD in August 2023, but the company only provided mitigation steps instead of patching this. However, Microsoft has acted upon this and released patches to fix this vulnerability.
Critical Vulnerabilities
According to the updates from Microsoft, four of the critical severity vulnerabilities were CVE-2023-35630 (Remote Code Execution), CVE-2023-35628 (Remote Code Execution), CVE-2023-35641 (Remote Code Execution), and CVE-2023-36019 (Spoofing).
The RCEs existed in several Microsoft products, including Microsoft Windows Server (2012, 2008, 2016, 2019, 2022), Windows 10, Windows 11, and others.
The spoofing vulnerability existed in two of Microsoft’s products: Azure Logic Apps and Microsoft Power Platform.
As for the Remote Code execution vulnerabilities, the other 5 were marked as “Important” by Microsoft. Microsoft has released security patches for all the affected Microsoft Products.
A complete list of patches and vulnerabilities has been released by Microsoft, which provides detailed information about the products that were affected and their patched versions.
Users of these Microsoft products are recommended to upgrade to the latest versions to prevent threat actors from exploiting these vulnerabilities.