Pierluigi Paganini May 13, 2020

Microsoft May 2020 Patch Tuesday security updates address 111 vulnerabilities impacting 12 different products, including Windows, Edge, IE, and Office,

Microsoft issued May 2020 Patch Tuesday security updates that addressed 111 vulnerabilities impacting 12 products, including Microsoft Windows, Microsoft Edge, ChakraCore, Internet Explorer, Microsoft Office, and Microsoft Office Services and Web Apps, Visual Studio, Microsoft Dynamics, .NET Framework, .NET Core, and Power BI.

16 of 111vulnerabilities are rated as Critical severity, and 95 are rated as Important in severity.

“Eleven of these CVEs were reported through the ZDI program. None of the bugs being patched are listed as being publicly known or under active attack at the time of release.” reported ZDI. “That makes three months in a row that Microsoft has released patches for more than 110 CVEs.”

None of the flaws addressed by Microsoft are being exploited in attacks in the wild.

Below a list of the most severe issues fixed by Microsoft with May 2020 Patch Tuesday security updates:

–      CVE-2020-1071 – Windows Remote Access Common Dialog Elevation of Privilege Vulnerability – An attacker could exploit the bug in the Remote Access Common Dialog to run arbitrary code with elevated privileges.

 –       CVE-2020-1135 – Windows Graphics Component Elevation of Privilege Vulnerability – This issue was demonstrated at the Pwn2Own by white-hat hackers from the Fluoroacetate team. The flaw could allow a logged-on user to take over a system by running a specially crafted program.

–       CVE-2020-1067 – Windows Remote Code Execution Vulnerability – The RCE issue impact Windows OS and could be exploited by an attacker to execute arbitrary code with elevated permissions on affected systems. The issue could be exploited only by attacker with a domain user account, the issue could be used for lateral movements once inside a target network.

Other severe bugs that could be exploited by attackers are:

• CVE-2020-1023, CVE-2020-1024, and CVE-2020-1102 – Microsoft SharePoint Remote Code Execution Vulnerability
• CVE-2020-1051, CVE-2020-1174, CVE-2020-1175, and CVE-2020-1176 – Jet Database Engine Remote Code Execution Vulnerability
• CVE-2020-1064 – MSHTML Engine Remote Code Execution Vulnerability
• CVE-2020-1096 – Microsoft Edge PDF Remote Code Execution Vulnerability

Below the full list of vulnerabilities addressed by Microsoft:

Pierluigi Paganini

(SecurityAffairs – Microsoft May 2020 Patch Tuesday, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]