Welcome back to this month’s Patch Tuesday. Microsoft has patched 53 vulnerabilities this month, with 17 rated critical and 34 rated important. The majority of the critical vulnerabilities reside in Microsoft’s Chakra engine that parses Jscript. The Chakra engine is a core component of Microsoft’s web browsers.
Internet Explorer and Edge
Microsoft’s browsers received a host of critical fixes this month. Four vulnerabilities in the Chakra engine could lead to remote code execution when parsing malicious Jscript content. Microsoft has indicated that these vulnerabilities are likely to be targeted for an exploit in the wild, and are a priority to patch for workstation systems.
Kernel
As usual, the Windows kernel itself received a number of fixes. The vulnerabilities had an impact of information disclosure that could lead to elevation of privilege. These vulnerabilities revolved around the mishandling of objects in memory.
Windows DNS
Unlike last month’s wormable remote code execution bug in Windows DNS server’s DNSAPI, this vulnerability only causes Denial of Service by sending a malformed DNS response. This can still have a devastating impact on a network infrastructure and should be taken seriously. Microsoft rates this vulnerability as important, with exploitation less likely.
Office
Office received the usual amount of attention it gets every patch Tuesday. None of the office vulnerabilities were rated as critical. Attackers leveraging these vulnerabilities would be able to remotely execute code with privileges equal to that of the current user, obtain sensitive information on the system, and elevate privileges. Be sure to verify the source of Office files before opening them to help protect against these kinds of vulnerabilities.
Adobe Flash Player
Adobe Flash Player received two fixes this month. One was an out-of-bounds read that discloses potentially sensitive information to an attacker, and the other was a type confusion bug that allowed for arbitrary code execution. The two vulnerabilities are rated Important and Critical, respectively. Neither of these vulnerabilities are actively being exploited in the wild.
.Net Framework
Microsoft’s .Net Framework has not received an update since May, so it was due. The framework received fixes for multiple vulnerabilities. These vulnerabilities had impacts of allowing an attacker to gain elevated privileges, remote code execution, and bypass security features. Microsoft rates these vulnerabilities as important.
