Patch Tuesday Microsoft's monthly patch drop has arrived, delivering a mere 61 CVE-tagged vulnerabilities - none listed as under active attack or already known to the public.
The second critical vulnerability, CVE-2024-21408, is a denial of service flaw in Hyper-V that earned a 5.5 CVSS rating as it means an attacker could send a specially crafted packet to a Hyper-V server and induce a denial-of-service attack.
The most severe flaw this month in terms of CVSS scores is CVE-2024-21334, a 9.8-rated Open Management Infrastructure RCE vulnerability.
It would allow a remote, unauthenticated attacker to access the OMI instance from the internet, send a specially crated request, and trigger a user-after-free vulnerability.
Microsoft's bulletin details the commands needed to shore up this flaw, so be sure to check it out and patch ASAP. Adobe addresses 56 bugs.
Adobe's monthly patch-a-thon saw the outfit release six fixes addressing 56 vulnerabilities in Experience Manager, Premiere Pro, ColdFusion, Bridge, Lightroom and Animate.
The other two are improper input validation vulnerabilities that could be exploited to bypass security features.
The patch for Premiere Pro fixes two critical-severity bugs, and the ColdFusion update also addresses a critical vulnerability that could be abused for code execution.
Both Adobe Bridge and Adobe Animate shore up four critical and important CVEs, while the Lightroom patch fixes one critical vulnerability.
CVE-2023-32282 is a race-condition vulnerability in BIOS firmware for some Intel processors that could allow a privileged user to escalate privilege if they enjoy local access.
AMD recommends customers follow its earlier guidance [PDF] on mitigating Spectre-type attacks to address this vulnerability.
Hot News Note #3425274 fixes a 9.4-rated code injection vulnerability in applications built with SAP Build Apps.
Hot News Note #3433192 addresses a 9.1-rated code injection vulnerability in SAP NetWeaver AS Java.
Cisco today updated an earlier, 9.1-rated critical vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software.
It could allow an unauthenticated, remote attacker to perform a carriage return line feed injection attack against a user.
There's another critical-rated System vulnerability tracked as CVE-2024-23717 that could allow elevation of privilege.
CVE-2023-48788, another 9.3-rated SQL-injection flaw in FortiClient Enterprise Management Server could allow an unauthenticated attacker to send specially crafted requests and then execute unauthorized code.
A 7.7-rated improper access control vulnerability tracked as CVE-2023-36554 means FortiWLM MEA for FortiManager could also be exploited by an unauthenticated, remote attacker to execute arbitrary commands.
Then there's a high-severity authorization bypass flaw in multiple versions of FortiOS and FortiProxy SSLVPN bookmarks, which could allow an authenticated attacker to gain access to another user's bookmarks via URL manipulation.
Finally, CVE-2023-46717 is a 6.7-rated improper authentication vulnerability in multiple versions of FortiOS that can allow escalation of privilege.
This Cyber News was published on go.theregister.com. Publication date: Wed, 13 Mar 2024 00:43:08 +0000