Pierluigi Paganini May 12, 2021

Microsoft Patch Tuesday for May 2021 security updates addressed 55 vulnerabilities, four are rated as Critical.

Microsoft Patch Tuesday for May 2021 security updates address 55 vulnerabilities in Microsoft Windows, .NET Core and Visual Studio, Internet Explorer (IE), Microsoft Office, SharePoint Server, Open-Source Software, Hyper-V, Skype for Business and Microsoft Lync, and Exchange Server.

Four vulnerabilities are rated as Critical, 50 as Important and the remaining one as Moderate severity.

Three of these bugs are publicly known but none are actively exploited in the wild at the time of release, 13 of these bugs were reported through the ZDI program.

The critical issues addressed by Microsoft are:

CVE-2021-31166 – HTTP Protocol Stack Remote Code Execution Vulnerability
The flaw could be exploited by an unauthenticated attacker by sending a specially crafted packet to a targeted server utilizing the HTTP Protocol Stack (http.sys) to process packets

CVE-2021-28476 – Hyper-V Remote Code Execution Vulnerability
The flaw could allow a guest VM to force the Hyper-V host’s kernel to read from an arbitrary, potentially invalid address.

CVE-2021-27068 – Visual Studio Remote Code Execution Vulnerability
CVE-2020-24587 – Windows Wireless Networking Information Disclosure Vulnerability
An attacker can trigger this issue to disclose the contents of encrypted wireless packets on an affected system.

The full list of CVEs released by Microsoft for May 2021 is available here.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Microsoft Patch Tuesday)

[adrotate banner=”5″]

[adrotate banner=”13″]