Pierluigi Paganini
June 13, 2023
Microsoft Patch Tuesday security updates for June 2023 fixed 69 vulnerabilities in multiple products, including Microsoft Windows and Windows Components; Office and Office Components; Exchange Server; Microsoft Edge (Chromium-based); SharePoint Server; .NET and Visual Studio; Microsoft Teams; Azure DevOps; Microsoft Dynamics; and the Remote Desktop Client.
Six out of 69 vulnerabilities addressed by Microsoft are rated Critical, 62 are rated Important, and one is rated Moderate in severity. None of the vulnerabilities have been publicly known or exploited in the wild.
Five of these vulnerabilities were submitted through the ZDI program.
Below are the descriptions of some of the most interesting issues addressed by Microsoft:
CVE-2023-29363, CVE-2023-32014 and CVE-2023-32015 (CVSS 9.8) – Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerabilities.
A remote, unauthenticated attacker can trigger these vulnerabilities to execute arbitrary code on a vulnerable system where the message queuing service is running in a Pragmatic General Multicast (PGM) Server environment. Pragmatic General Multicast (PGM) is a reliable multicast computer network transport protocol. It is important to highlight that PGM is not enabled by default.
CVE-2023-32021 (CVSS 7.1) – Microsoft Exchange Server Remote Code Execution Vulnerability.
The issue is a remote code execution bug in Microsoft Exchange Server that can be exploited by an attacker to bypass issues that were previously exploited in the wild. A remote attacker can exploit this flaw to execute arbitrary code with SYSTEM privileges.
CVE-2023-3079 – Chromium: CVE-2023-3079 Type Confusion in V8
This vulnerability is a type confusion bug in Chrome that could lead to code execution at the level of the logged-on user. This flaw was first discovered by the Chrome team on June 1 and is actively exploited in malware attacks.
The full list of vulnerabilities fixed by Microsoft with the release of Patch Tuesday security updates for June 2023 is available here.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Patch Tuesday)
