Microsoft Fixes Three Zero-Days in May Patch Tuesday

System administrators have over 60 CVEs to address in the latest Microsoft Patch Tuesday, including three zero-day vulnerabilities.
Of these three zero-day bugs, two have been actively exploited in the wild, the most prominent of which has been used to deliver QuakBot and other malware.
It is an elevation of privilege vulnerability which stems from a heap-based buffer overflow in the Windows Desktop Window Manager Core Library.
These privileges could be used to disable security features, steal sensitive data or conduct lateral movement across a victim network, Walters added.
The second actively exploited zero-day is CVE-2024-30040, a Windows MSHTML platform security feature bypass flaw.
Finally, Microsoft also patched a denial-of-service flaw in Microsoft Visual Studio which it claimed was publicly disclosed but not currently exploited.
The only critical CVE of the 61 fixed this month was CVE-2024-30044, a remote code execution bug in Microsoft SharePoint Server.

This Cyber News was published on www.infosecurity-magazine.com. Publication date: Wed, 15 May 2024 08:55:08 +0000