Microsoft fixes 2 zero-days on December 2022 Patch Tuesday

Microsoft fixes 2 zero-days on December 2022 Patch Tuesday

On 13th December 2022 was the December Patch Tuesday, and 2 zero-day vulnerabilities and 49 flaws were fixed.

  • 23 Remote Code Execution Vulnerabilities
  • 19 Elevation of Privilege Vulnerabilities
  • 3 Information Disclosure Vulnerabilities
  • 3 Denial of Service Vulnerabilities
  • 2 Security Feature Bypass Vulnerabilities
  • 1 Spoofing Vulnerability

The two actively exploiting vulnerabilities are,

CVE-2022-44698 – Windows SmartScreen Security Feature Bypass Vulnerability

Product – Windows Server 2016, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 22H2 for 32-bit Systems, Windows 10 Version 22H2 for x64-based Systems, Windows 10 Version 22H2 for ARM64-based Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for 32-bit Systems, Windows 11 for x64-based Systems, Windows 10 Version 20H2 for ARM64-based Systems, Windows 10 Version 20H2 for 32-bit Systems, Windows 10 Version 20H2 for x64-based Systems, Windows Server 2022 Datacenter: Azure Edition, Windows 11 for ARM64-based Systems, Windows Server 2022, Windows 10 Version 21H1 for 32-bit Systems, Windows 10 Version 21H1 for ARM64-based Systems, Windows 10 Version 21H1 for x64-based Systems, Windows Server 2019, Windows 10 Version 1809 for ARM64-based Systems, Windows 10 Version 1809 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems

“An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.”

CVE-2022-44710 – DirectX Graphics Kernel Elevation of Privilege Vulnerability

Product –  Windows 11 Version 22H2 for ARM64-based System

“Successful exploitation of this vulnerability requires an attacker to win a race condition. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges and could lead to a contained execution environment escape”

Source

https://msrc.microsoft.com/update-guide/

https://www.bleepingcomputer.com/news/microsoft/microsoft-december-2022-patch-tuesday-fixes-2-zero-days-49-flaws/

 

Copy link
Powered by Social Snap