Microsoft Windows Security Updates January 2023 overview

[mkoundo]

Content source

https://www.bleepingcomputer.com/news/microsoft/microsoft-january-2023-patch-tuesday-fixes-98-flaws-1-zero-day/

Microsoft January 2023 Patch Tuesday fixes 98 flaws, 1 zero-day​

Today is Microsoft's January 2023 Patch Tuesday, and with it comes fixes for an actively exploited zero-day vulnerability and a total of 98 flaws.

This is the first Patch Tuesday of 2023, and it fixes a whopping 98 vulnerabilities, with eleven of them classified as 'Critical.'

Microsoft gave the vulnerabilities this severity rating as they allow remote code execution, bypass security features, or elevate privileges.

The number of bugs in each vulnerability category is listed below:

• 39 Elevation of Privilege Vulnerabilities
• 4 Security Feature Bypass Vulnerabilities
• 33 Remote Code Execution Vulnerabilities
• 10 Information Disclosure Vulnerabilities
• 10 Denial of Service Vulnerabilities
• 2 Spoofing Vulnerabilities

Microsoft January 2023 Patch Tuesday fixes 98 flaws, 1 zero-day

Today is Microsoft's January 2023 Patch Tuesday, and with it comes fixes for an actively exploited zero-day vulnerability and a total of 98 flaws.

www.bleepingcomputer.com

 

[Gandalf_The_Grey]

The Januari 2023 Security Update Review

Welcome to the first patch Tuesday of the new year. As expected, Adobe and Microsoft have released their latest fixes and updates. Take a break from your regularly scheduled activities and join us as we review the details of their latest security offerings.

Adobe Patches for January 2023

For January, Adobe released four patches addressing 29 CVEs in Adobe Acrobat and Reader, InDesign, InCopy, and Adobe Dimension. A total of 22 of these bugs were submitted through the ZDI program. The update for Reader fixes 15 bugs with eight of these being ranked Critical in severity. The most severe of these would allow arbitrary code execution if an affected system opened a specially crafted file. The patch for InDesign fixes six bug, four of which are rated Critical. Similar to the Reader patch, opening a malicious file could result in code execution. That’s also true for InCopy, which also received fixes for six CVEs. The update for Dimension only addresses two CVEs, but the fix also includes an update for dependencies in SketchUp. The old version has February 22 timestamp, while the version shipped today is stamped November 9.

None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. Adobe categorizes these updates as a deployment priority rating of 3.

Microsoft Patches for January 2023

This month, Microsoft released 98 new patches addressing CVEs in Microsoft Windows and Windows Components; Office and Office Components; .NET Core and Visual Studio Code, 3D Builder, Azure Service Fabric Container, Windows BitLocker, Windows Defender, Windows Print Spooler Components, and Microsoft Exchange Server. A total of 25 of these CVEs were submitted through the ZDI program.

Of the 98 new patches released today, 11 are rated Critical and 87 are rated Important in severity. This volume is the largest we’ve seen from Microsoft for a January release in quite some time. It will be interesting to see if this volume of fixes continues throughout the year.

One of the new CVEs released this month is listed as publicly known and one is listed as being in the wild at the time of release.

Zero Day Initiative — The January 2023 Security Update Review

Welcome to the first patch Tuesday of the new year. As expected, Adobe and Microsoft have released their latest fixes and updates. Take a break from your regularly scheduled activities and join us as we review the details of their latest security offerings. Adobe Patches for January 2023 For Jan

www.zerodayinitiative.com

 

[Zero Knowledge]

Windows BitLocker

Interested to find out what the bug/exploit is for BL. You don't see them often.

 

[Gandalf_The_Grey]

Interested to find out what the bug/exploit is for BL. You don't see them often.

Not much info to be found:

A successful attacker could bypass the BitLocker Device Encryption feature on the system storage device. An attacker with physical access to the target could exploit this vulnerability to gain access to encrypted data.

Security Update Guide - Microsoft Security Response Center

msrc.microsoft.com