Security News ZDI: The October 2024 Security Update Review

[Gandalf_The_Grey]

Content source

https://www.zerodayinitiative.com/blog/2024/10/8/the-october-2024-security-update-review

It’s the spooky season, and there’s nothing spookier than security patches – at least in my world. Microsoft and Adobe have released their latest patches, and no bones about it, there are some skeletons in those closets. Take a break from your regular activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release.

Adobe Patches for October 2024

For October, Adobe released nine patches addressing 52 CVEs in Adobe Substance 3D Painter, Commerce, Dimension, Animate, Lightroom, InCopy, InDesign, Substance 3D Stager, and Adobe FrameMaker. Two of these bugs were submitted through the ZDI program. The largest and most urgent of these patches covers 22 CVEs in Adobe Commerce, which includes fixes for Critical-rated code execution bugs. Although not listed as public or under attack, Adobe lists this as Priority 2. The update for Dimension fixes two Critical-rated bugs that could lead to code execution. The fix for Animate fixes 11 vulnerabilities, some of which could lead to code execution. The Substance 3D Stager patch covers eight bugs – all of which are rated Critical and could lead to code execution. The five CVEs addressed by the FrameMaker fix are also all Critical-rated code execution bugs. The remaining bulletins all address only a single CVE each. The memory leak in Substance 3D Painter is rated Important. That’s the same for the Lightroom patch. The InCopy patch fixes a Critical-rated unrestricted upload bug, which is also the case for the InDesign fix.

None of the bugs fixed by Adobe this month are listed as publicly known or under active attack at the time of release. Outside of the fix for Commerce, Adobe categorizes these updates as a deployment priority rating of 3.

Microsoft Patches for October 2024

This month, Microsoft released 117 new CVEs in Windows and Windows Components; Office and Office Components; Azure; .NET and Visual Studio; OpenSSH for Windows; Power BI; Windows Hyper-V; and Windows Mobile Broadband. One of these vulnerabilities was reported through the ZDI program. With the addition of the third-party CVEs, the entire release tops out at 121 CVEs.

Of the patches being released today, three are rated Critical, 115 are rated Important, and two are rated Moderate in severity. This is the third triple-digit CVE release from Microsoft this year, putting the Redmond giant on pace to exceed the number of CVEs fixed in 2023. They are still a way off from the record pace set in 2020 (thankfully).

Five of these CVEs are listed as publicly known, and two of these are listed as under active attack at the time of release.

Looking Ahead

The next Patch Tuesday of 2024 will be on November 12, and, assuming I survive Pwn2Own Ireland, I’ll return with details and patch analysis then. Until then, keep the lights on, stay safe, happy patching, and may all your reboots be smooth and clean!

Zero Day Initiative — The October 2024 Security Update Review

It’s the spooky season, and there’s nothing spookier than security patches – at least in my world. Microsoft and Adobe have released their latest patches, and no bones about it, there are some skeletons in those closets. Take a break from your regular activities and join us as we review the details

www.zerodayinitiative.com

 

[Gandalf_The_Grey]

Microsoft October 2024 Patch Tuesday fixes 5 zero-days, 118 flaws

Today is Microsoft's October 2024 Patch Tuesday, which includes security updates for 118 flaws, including five publicly disclosed zero-days, two of which are actively exploited.

This Patch Tuesday fixed three critical vulnerabilities, all remote code execution flaws.

The number of bugs in each vulnerability category is listed below:

• 28 Elevation of Privilege vulnerabilities
• 7 Security Feature Bypass vulnerabilities
• 43 Remote Code Execution vulnerabilities
• 6 Information Disclosure vulnerabilities
• 26 Denial of Service vulnerabilities
• 7 Spoofing vulnerabilities

This count does not include three Edge flaws that were previously fixed on October 3rd.

To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5044284 and KB5044285 cumulative updates and the Windows 10 KB5044273 update.

Microsoft October 2024 Patch Tuesday fixes 5 zero-days, 118 flaws

Today is Microsoft's October 2024 Patch Tuesday, which includes security updates for 118 flaws, including five publicly disclosed zero-days, two of which are actively exploited.

www.bleepingcomputer.com

 

[Gandalf_The_Grey]

Ghacks: Microsoft releases the October 2024 security updates for Windows

Microsoft has released the October 2024 cumulative updates for all supported versions of the Windows operating system. It is the last month that Windows 11, version 22H2 is receiving an update as support runs out for the operating system after today's releases.

This update overview provides system administrators and home users with actionable information about the released security updates. It includes information about the released updates, how certain versions of Windows are affected, and the known issues that Microsoft confirmed for each of the versions.

You may download the following Excel spreadsheet to get a list of released updates. Click on the following link to download the archive to the local device: Windows Security Updates October 2024

Microsoft releases the October 2024 security updates for Windows - gHacks Tech News

The October 2024 Security Updates for Windows 10 and 11 are out. Find out what is new, changed and which known issues exist.

www.ghacks.net