Patch Tuesday, Microsoft’s month-to-month report of safety updates, introduced 90 CVEs, together with some vulnerabilities that have been being actively exploited.
Some vulnerabilities originated in Chromium, that means each Microsoft Edge and Google Chrome could have been affected. Listed below are probably the most important flaws and patches disclosed by Microsoft on Aug. 13.
Six zero-day flaws had been exploited
Risk actors had already taken benefit of six zero-day exploits specifically:
- CVE-2024-38106: an elevation of privilege vulnerability within the Home windows kernel.
- CVE-2024-38107: an elevation of privilege vulnerability within the Home windows Energy Dependency Coordinator.
- CVE-2024-38178: wherein distant code execution might have been potential if a consumer clicked a hyperlink utilizing Edge in Web Explorer Mode.
- CVE-2024-38189: wherein opening a malicious Microsoft Workplace Undertaking file below sure situations might allow distant code execution.
- CVE-2024-38193: an elevation of privilege vulnerability that would give an attacker SYSTEM privileges.
- CVE-2024-38213: wherein an attacker might bypass the SmartScreen safety that pops up when a consumer downloads one thing from the web.
SEE: Organizations could wish to assess how their privateness and knowledge storage insurance policies intersect with Microsoft’s Copilot AI.
NIST labels two vulnerabilities as ‘important’
Different notable objects on this month’s Patch Tuesday have been these rated as important in accordance with the Nationwide Vulnerability Database’s Frequent Vulnerability Scoring System from NIST. These have been:
- CVE-2024-38140: a distant code execution vulnerability that would happen if a program was utilizing a Pragmatic Normal Multicast port to pay attention.
- CVE-2024-38063: a distant code execution vulnerability enabled by sending repeated malicious IPv6 packets.
One other vulnerability, CVE-2024-38202, is outstanding as a result of Microsoft has not but launched a patch for it. To mitigate this elevation of privilege vulnerability in Home windows Replace, Redmond recommends auditing consumer entry to things, operations, and recordsdata.
The whole steps for safeguarding in opposition to this vulnerability could be discovered within the beneficial actions part of the vulnerability’s itemizing.
A gaggle of vulnerabilities originate in Chromium
Enterprise customers world wide ought to use probably the most up-to-date variations of Edge in addition to Google Chrome, since a number of the vulnerabilities originate within the Chromium Open Supply Software program utilized in each browsers.
Related Chrome and Chromium vulnerabilities are as follows:
- MITRE CVE 7532: potential out-of-bounds reminiscence entry in ANGLE, a graphics engine layer in Chrome.
- MITRE CVE 7533: a use-after-free exploit on Chrome in iOS.
- MITRE CVE 7534: heap buffer overflow in Structure.
- MITRE CVE 7535: inappropriate implementation in V8.
- MITRE CVE 7536: a use-after-free exploit in WebAudio.
- MITRE CVE 7550: Sort Confusion in V8.
- MITRE CVE 38218: an HTML-based memory-corruption vulnerability in Microsoft Edge.
- MITRE CVE 38219: a distant code execution vulnerability in Microsoft Edge.
Attackers might have probably used these vulnerabilities to carry out arbitrary code execution earlier than they have been patched.
Reminder: hold browsers and working programs updated
Most exploits talked about within the patch report are lined by the August safety updates, so the one motion directors want to soak up response is to maintain updated.
Equally, the mitigation for these Chromium flaws is to replace Microsoft Edge or Google Chrome to the most recent variations.
In Edge, examine which model is working and discover updates by going to the meatball menu (…) on the right-hand facet. Choose “Assist” and “Suggestions,” then choose “Microsoft Edge.”
In Chrome, choose “About Google Chrome” within the menu bar or choose the kebab menu (three vertical dots) on the top-right of the window. From there, choose “Assist,” then “About Google Chrome.”
