Microsoft Patch Tuesday for June 2023 fixes 6 critical flaws

Microsoft Patch Tuesday security updates for June 2023 fixed 69 flaws in its products, including six critical issues.

Microsoft Patch Tuesday security updates for June 2023 fixed 69 vulnerabilities in multiple products, including Microsoft Windows and Windows Components; Office and Office Components; Exchange Server; Microsoft Edge (Chromium-based); SharePoint Server; .NET and Visual Studio; Microsoft Teams; Azure DevOps; Microsoft Dynamics; and the Remote Desktop Client.

Six out of 69 vulnerabilities addressed by Microsoft are rated Critical, 62 are rated Important, and one is rated Moderate in severity. None of the vulnerabilities have been publicly known or exploited in the wild.

Five of these vulnerabilities were submitted through the ZDI program.

Below are the descriptions of some of the most interesting issues addressed by Microsoft:

CVE-2023-29363, CVE-2023-32014 and CVE-2023-32015 (CVSS 9.8) – Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerabilities.

A remote, unauthenticated attacker can trigger these vulnerabilities to execute arbitrary code on a vulnerable system where the message queuing service is running in a Pragmatic General Multicast (PGM) Server environment. Pragmatic General Multicast (PGM) is a reliable multicast computer network transport protocol. It is important to highlight that PGM is not enabled by default.

CVE-2023-32021 (CVSS 7.1) – Microsoft Exchange Server Remote Code Execution Vulnerability.

The issue is a remote code execution bug in Microsoft Exchange Server that can be exploited by an attacker to bypass issues that were previously exploited in the wild. A remote attacker can exploit this flaw to execute arbitrary code with SYSTEM privileges.

CVE-2023-3079 – Chromium: CVE-2023-3079 Type Confusion in V8

This vulnerability is a type confusion bug in Chrome that could lead to code execution at the level of the logged-on user. This flaw was first discovered by the Chrome team on June 1 and is actively exploited in malware attacks.

The full list of vulnerabilities fixed by Microsoft with the release of Patch Tuesday security updates for June 2023 is available here.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Patch Tuesday)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.