Microsoft has released its latest Patch Tuesday updates for June 2021 to remediate major security shortcomings in its Windows Operating System and other software components. The updates are aimed at addressing vulnerabilities and strengthening the security of Microsoft’s products and services.
With a total of 73 flaws, six have been rated as Critical, 63 as Important, two as Moderate, and one as Low in severity. Additionally, three issues were addressed in the tech giant’s Chromium-based Edge browser.
The absence of any zero-day flaws in Microsoft products is noteworthy and marks the first time in several months that the company has released an update without any flaws being publicly known or under active attack at the time of release.
Here’s a closer look at the top fixes made in Microsoft’s June 2023 Patch Tuesday updates
Out of the 73 flaws, six are rated as critical, making them the most severe. These vulnerabilities pose a high risk of exploitation and could lead to a number of attacks, such as remote code execution, elevation of privilege, and sensitive information disclosure.
Meanwhile, 63 have been classified as important, meaning they have the potential to cause significant harm if left unaddressed. These flaws could allow an attacker to gain unauthorized access, alter data, or cause a denial of service (DoS) attack.
The remaining two flaws are of moderate severity, while one is low in severity
As part of June’s Patch Tuesday updates, Microsoft addressed three issues in the Chromium-based Edge browser, two of which were rated as Important while one was rated as Moderate.
Two of the fixes addressed security bypass vulnerabilities that could allow an attacker to bypass security features and obtain sensitive information. Meanwhile, the moderate-rated flaw was a spoofing vulnerability that could enable a remote attacker to trick a user into disclosing information.
No zero-day flaws
A key highlight of the latest update is the absence of any known zero-day flaws that are being publicly exploited at the time of release. By proactively addressing vulnerabilities before they can be exploited, Microsoft’s latest Patch Tuesday updates help minimize the risk of attacks and protect users from potential harm.
One of the major fixes in this patch is CVE-2023-29357 (CVSS score: 9.8), which is a privilege escalation flaw in SharePoint Server that attackers could exploit to gain administrator privileges. If left unaddressed, this flaw could enable an attacker to gain full control of the affected system.
Another notable update fixed three critical remote code execution bugs (CVE-2021-29363, CVE-2021-32014, and CVE-2021-32015 with CVSS scores of 9.8) in Windows Pragmatic General Multicast (PGM). This protocol is designed to deliver packets between multiple network members reliably. These vulnerabilities could have allowed attackers to remotely execute code and compromise affected systems.
This is not the first time that Microsoft has addressed a flaw in this component. In April 2023, the company also fixed a similar vulnerability (CVE-2023-28250, CVSS score: 9.8).
Additionally, the company resolved two remote code execution bugs impacting Exchange Server (CVE-2021-28310 and CVE-2021-32031), which could have permitted an authenticated attacker to achieve remote code execution on affected installations.
Other vendors’ security updates
Apart from Microsoft, other vendors have also released security updates in the past few weeks to address several vulnerabilities.
One such vulnerability is CVE-2023-3079, a zero-day bug that Google disclosed as being actively exploited in the wild last week.
Microsoft’s latest Patch Tuesday updates for June 2023 highlight the company’s continued efforts to enhance the security of its products and services. With 73 flaws addressed, including six critical vulnerabilities, the update is an essential step towards securing Microsoft’s systems and users. Furthermore, the absence of any zero-day flaws demonstrates the importance of proactive security measures and continuous efforts to identify and mitigate vulnerabilities.