Microsoft July 2025 Patch Tuesday fixes one zero-day, 137 flaws

[Gandalf_The_Grey]

Content source

https://www.bleepingcomputer.com/news/microsoft/microsoft-july-2025-patch-tuesday-fixes-one-zero-day-137-flaws/

Today is Microsoft's July 2025 Patch Tuesday, which includes security updates for 137 flaws, including one publicly disclosed zero-day vulnerability in Microsoft SQL Server.

This Patch Tuesday also fixes fourteen "Critical" vulnerabilities, ten of which are remote code execution vulnerabilities, one is an information disclosure, and two are AMD side channel attack flaws.

The number of bugs in each vulnerability category is listed below:

• 53 Elevation of Privilege Vulnerabilities
• 8 Security Feature Bypass Vulnerabilities
• 41 Remote Code Execution Vulnerabilities
• 18 Information Disclosure Vulnerabilities
• 6 Denial of Service Vulnerabilities
• 4 Spoofing Vulnerabilities

These counts do not include four Mariner and three Microsoft Edge issues fixed earlier this month.

To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5062553 & KB5062552 cumulative updates and the Windows 10 KB5062554 cumulative update.

Microsoft July 2025 Patch Tuesday fixes one zero-day, 137 flaws

Today is Microsoft's July 2025 Patch Tuesday, which includes security updates for 137 flaws, including one publicly disclosed zero-day vulnerability in Microsoft SQL Server.

www.bleepingcomputer.com

 

[Gandalf_The_Grey]

ZDI: The July 2025 Security Update Review

It’s the second Tuesday of the month, and as expected, Adobe and Microsoft have released their latest security patches. Take a break from your scheduled activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check it out here:

Adobe Patches for July 2025

For July, Adobe (eventually) released 13 bulletins addressing 60 unique CVEs in Adobe ColdFusion, After Effects, Substance 3D Viewer, Audition, InCopy, InDesign, Connect, Dimension, Substance 3D Stager, Illustrator, FrameMaker, Experience Manager Forms, and Experience Manager Screens. The obvious place to start here is ColdFusion. It’s the only update listed as Priority 1 and addresses 13 CVEs, five of which are rated Critical. ColdFusion should probably be considered “legacy” at this point. If you’re still using it, you should think about migrating to something more modern. The patch for FrameMaker is also somewhat large. It fixes 15 CVEs – including 13 Critical bugs that could lead to code execution. The only other double-digit CVE bulletin is for Illustrator with 10 bugs. The most severe of these bugs could lead to code execution.

The remaining patches are much smaller. The After Effects patch fixes two Important severity bugs. The fix for Substance 3D Viewer addresses one Critical and two Important vulnerabilities. There’s a single denial-of-service (DoS) bug fixed in the Audition patch. The update for InCopy includes three Critical-rated bugs that could lead to code execution. The fixes for InDesign correct six similar Critical bugs. There’s just a single Critical bug in the patch for Connect. That’s the same for the Experience Manager Forms patch. The update for Substance 3D Stager corrects a single memory leak. The patch for Dimension also includes a memory leak fix and a Critical-rated code execution bug. Finally, the update for Experience Manager Screens addresses two cross-site scripting (XSS) bugs.

None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. Besides the patch for ColdFusion, all updates are listed as deployment priority 3.

Microsoft Patches for June 2025

This month, Microsoft released a whopping 130 new CVEs in Windows and Windows Components, Office and Office Components, .NET and Visual Studio, Azure, Teams, Hyper-V, Windows BitLocker, Microsoft Edge (Chromium-based), and the Windows Cryptographic Service. Eight of these bugs were reported through the Trend ZDI program. With the additional third-party CVEs being documented, it brings the combined total to 140 CVEs.

Of the patches released today, 10 are rated Critical, and the rest are rated Important in severity. July tends to be a heavier month for patches, though the reason is not clear. Perhaps Microsoft wants to patch as much as possible prior to the Black Hat and DEFECON conferences that take place in early August. Perhaps it’s related to their test cycles and is merely coincidental.

Microsoft lists one bug as being publicly known at the time of release, but nothing is noted as being under active attack.

Looking Ahead

The next Patch Tuesday of 2025 will be on August 12, and, assuming I survive hacker summer camp, I’ll be back then with my analysis and thoughts about the release. Until then, stay safe, happy patching, and may all your reboots be smooth and clean!

Zero Day Initiative — The July 2025 Security Update Review

It’s the second Tuesday of the month, and as expected, Adobe and Microsoft have released their latest security patches. Take a break from your scheduled activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire rel

www.zerodayinitiative.com

 

[Gandalf_The_Grey]

Ghacks: Microsoft Windows Security Updates for July 2025 are now available

The July 2025 security updates for Windows and other Microsoft products are now available. Microsoft released the updates a moment ago. This overview offers detailed information about the released updates to inform system administrators and home users alike.

The overview lists download and resource links for each update, known issues as confirmed by Microsoft, and more.

You may download the following Excel spreadsheet to get a list of released updates. Click on the following link to download the archive to the local device: Microsoft Windows July 2025 security updates

Microsoft Windows Security Updates for July 2025 are now available - gHacks Tech News

An overview of the security updates that Microsoft released on the July 2025 Patch Day for Windows and other company products.

www.ghacks.net