Microsoft has fixed three exploited zero-day vulnerabilities in its February 14 patch Tuesday update, which also fixed 77 flaws, including nine critical ones. These nine vulnerabilities allowed remote code execution on vulnerable devices.
As for the three actively exploited zero-day vulnerabilities affect the Windows Graphics component, Microsoft Publisher and the Windows Common Log File System driver.
| CVE code | Affected product | Vulnerability type | Description |
|---|---|---|---|
| CVE-2023-21823 | Windows Graphics Component | Remote code execution | If exploited, allows a hacker to remotely execute commands with System-level privileges. |
| CVE-2023-21715 | Microsoft Publisher | Security features bypass | If exploited, allows an attacker to allow macros in a malicious Publisher document to run without warning the user. |
| CVE-2023-23376 | Windows Common Log File System driver | Privilege escalation | If exploited, allows an attacker to gain System-level privileges. |
The nine critical vulnerabilities affect .NET, Visual Studio, Word, SQL Server, Windows iSCSI and Windows Protected EAP (PEAP). These are tracked with the following CVE codes:
| CVE Code | Affected Product | Vulnerability type |
|---|---|---|
| CVE-2023-21808 | .NET and Visual Studio | Remote code execution |
| CVE-2023-21716 | Microsoft Office Word | Remote code execution |
| CVE-2023-21718 | SQL Server | SQL ODBC driver remote code execution |
| CVE-2023-21815 | Visual Studio | Remote code execution |
| CVE-2023-23381 | Visual Studio | Remote code execution |
| CVE-2023-21803 | Windows iSCSI | iSCSI Discovery Service remote code execution |
| CVE-2023-21692 | Windows Protected EAP (PEAP) | Remote code execution |
| CVE-2023-21690 | Windows Protected EAP (PEAP) | Remote code execution |
| CVE-2023-21689 | Windows Protected EAP (PEAP) | Remote code execution |
Overall, the updates labelled KB5022845 and KB5022836 for Windows 11 and KB5022834 and KB5022840 for Windows 10 fixed the following bugs.
- 12 Privilege escalation bugs
- 2 security bypass bugs
- 38 remote code execution (RCE) bugs
- 8 information disclosure bugs
- 10 DoS bugs
- 8 spoofing vulnerabilities
Keep in mind that some of these updates will be delivered using the Microsoft Store, meaning users who have disabled automatic updates from the Store will either have to manually install them or enable automatic updates from the Microsoft Store. The rest of the updates will be delivered through Windows Update and should install themselves automatically on most systems.
In the News: Pepsi Bottling Ventures leaks sensitive data in malware attack
