Today, Microsoft released patches for 64 different vulnerabilities in Microsoft products, 14 vulnerabilities in Chromium affecting Microsoft Edge, and five vulnerabilities affecting Microsoft's Linux distribution, Mariner. Three of these vulnerabilities are already being exploited, and three have been made public before the release of the patches. 

CVE-2023-36038: A denial of service vulnerability in ASP.NET Core. CVSS score of 8.2. This vulnerability was disclosed before the patch release.

CVE-2023-36413: A Microsoft Office security feature bypass. Exploiting this vulnerability will bypass the protected mode when opening a file received via the web. The file would open in editing mode, allowing malicious code execution. The vulnerability has been disclosed before the patch release.

CVE-2023-36036: A privilege escalation vulnerability in Microsoft's Windows Cloud Files Mini Filter Driver. This vulnerability is already being exploited.

CVE-2023-36033: A privilege escalation vulnerability in the Windows DWM Core Library. The vulnerability was exploited and disclosed before the patch release.

CVE-2023-36025: A security feature bypass vulnerability in Windows SmartScreen. This vulnerability was not public before the patch release, but it was already exploited.

Three of the vulnerabilities are considered critical. CVE-2023-36397, a remote code execution vulnerability in the Windows Pragmatic General Multicast (PGM) protocol, is noteworthy as we had patches for this in prior months. But exploitation should be difficult. It will require local network access and is not typically enabled. 

Today's patches also included patches for several older open-source component vulnerabilities in Kubernetes, FRRouting, Traceroute, PyYAML. These affect Mariner Linux, the Linux variant used by Microsoft. I decided not to include them in the matrix below.

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|