Microsoft Patch Tuesday
In today’s SensCy Cyber Brief, your SensCy team reviewed Microsoft’s latest series of patches released on Tuesday, November 14, 2023. Today’s Patch Tuesday comes with fixes for FIVE Zero-Day vulnerability and 58 flaws.
What is Patch Tuesday?
Patch Tuesday is Microsoft’s initiative to release new security fixes for the Windows operating system and any other Microsoft software on a monthly basis. Your SensCy team will monitor such releases and provide you with our observations and recommendations.
Why is it important?
This month’s patch Tuesday is critical because it fixes FIVE zero-day vulnerabilities (a vulnerability in a system or device that has been disclosed but is not yet patched). The SensCy team recommends Microsoft users install those patches immediately. Three of the zero-days are currently exploited.
CVE-2023-36036 is a Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability. “An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” explains Microsoft.
CVE-2023-36033 is a Windows DWM Core Library Elevation of Privilege Vulnerability. “An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” explains Microsoft.
CVE-2023-36025 is a Windows SmartScreen Security Feature Bypass Vulnerability. “The attacker would be able to bypass Windows Defender SmartScreen checks and their associated prompts,” explains Microsoft.
In addition to the zero-day fix, Microsoft is also fixing 104 vulnerabilities, with Five classified as “Critical” as they allow remote code execution.
Here is a breakdown of each vulnerability category:
- 16 Elevation of Privilege Vulnerability
- 6 Security Feature Bypass Vulnerabilities
- 15 Remote Code Execution Vulnerabilities
- 6 Information Disclosure Vulnerabilities
- 5 Denial of Service Vulnerabilities
- 11 Spoofing Vulnerabilities
For more information on vulnerabilities and the system that it affects, please refer to the full report from Microsoft linked here.
