Microsoft November 2023 Patch Tuesday fixes 5 zero-days, 58 flaws

Today is Microsoft’s November 2023 Patch Tuesday, which includes security updates for a total of 58 flaws and five zero-day vulnerabilities.

While fourteen remote code execution (RCE) bugs were fixed, Microsoft only rated one as critical. The three critical flaws fixed today are an Azure information disclosure bug, an RCE in Windows Internet Connection Sharing (ICS), and a Hyper-V escape flaw that allows the executions of programs on the host with SYSTEM privileges.

The number of bugs in each vulnerability category is listed below:

• 26 Elevation of Privilege Vulnerabilities
• 3 Security Feature Bypass Vulnerabilities
• 45 Remote Code Execution Vulnerabilities
• 12 Information Disclosure Vulnerabilities
• 17 Denial of Service Vulnerabilities
• 1 Spoofing Vulnerabilities

The total count of 58 flaws does not include 5 Mariner security updates and 20 Microsoft Edge security updates released earlier this month.

To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5032190 cumulative update and Windows 10 KB5032189 cumulative update.

Five zero-days fixed

This month’s Patch Tuesday fixes five zero-day vulnerabilities, with three exploited in attacks and three publicly disclosed.

Microsoft classifies a vulnerability as a zero-day if it is publicly disclosed or actively exploited with no official fix available.

The three actively exploited zero-day vulnerabilities in today’s updates are:

CVE-2023-36036 – Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Microsoft has fixed an actively exploited Windows Cloud Files Mini Filter Elevation of Privileges bug.

“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” explains Microsoft.

It is not known how the flaw was abused in attacks or by what threat actor.

The flaw was discovered internally by the Microsoft Threat Intelligence Microsoft Security Response Center.

CVE-2023-36033 – Windows DWM Core Library Elevation of Privilege Vulnerability

Microsoft has fixed an actively exploited and publicly disclosed Windows DWM Core Library vulnerability that can be used to elevate privileges to SYSTEM.

“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” explains Microsoft.

Microsoft says that the flaw was discovered by Quan Jin(@jq0904) with DBAPPSecurity WeBin Lab but did not share details on how they were used in attacks.

CVE-2023-36025 – Windows SmartScreen Security Feature Bypass Vulnerability

Microsoft has fixed an actively exploited Windows SmartScreen flaw that allows a malicious Internet Shortcut to bypass security checks and warnings.

“The attacker would be able to bypass Windows Defender SmartScreen checks and their associated prompts,” explains Microsoft.

“The user would have to click on a specially crafted Internet Shortcut (.URL) or a hyperlink pointing to an Internet Shortcut file to be compromised by the attacker,” continues Microsoft.

Microsoft says that the flaw was discovered by Will Metcalf (Splunk), Microsoft Threat Intelligence, and the Microsoft Office Product Group Security Team.

BleepingComputer contacted Splunk about the flaw to learn how it was exploited.

In addition, Microsoft says that two other publicly disclosed zero-day bugs, ‘CVE-2023-36413 – Microsoft Office Security Feature Bypass Vulnerability’ and the ‘CVE-2023-36038 — ASP.NET Core Denial of Service Vulnerability,’ were also fixed as part of today’s Patch Tuesday.

However, Microsoft says that they were not actively exploited in attacks.

Recent updates from other companies

Other vendors who released updates or advisories in November 2023 include:

The November 2023 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the November 2023 Patch Tuesday updates.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.