Microsoft hit the ground running with the first Patch Tuesday release for 2024, rolling out security fixes for at least 49 security defects in a wide range of Windows OS and software components.
The company called special attention to a pair of flaws with severe remote code execution risks, urging Windows fleet administrators to prioritize a feature bypass issue in Windows Kerberos and a race condition issue in Windows Hyper-V. The world's largest software maker called special attention to a Windows Kerberos security feature bypass flaw that can lead to remote code execution attacks, and a race condition issue in Windows Hyper-V. The Windows Kerberos problem, tracked as CVE-2024-20674, is described as an authentication feature that could be bypassed to allow impersonation.
The Windows Kerberos bug carries a CVSS severity rating of 9 out of 10.
Microsoft also urged immediate patching of the CVE-2024-20700 Windows Hyper-V vulnerability, warning that a race condition exposes the operating systgem to remote code execution attacks.
The Microsoft patches follow the release of patches from Adobe to cover at least six security defects in the Substance 3D Stager software product.
Adobe tagged the code-execution vulnerabilities with an 'important-severity' rating and urged users on both macOS and Windows platforms to immediately apply the updates.
This Cyber News was published on www.securityweek.com. Publication date: Tue, 09 Jan 2024 19:13:04 +0000