Microsoft: June 2023 Patch Tuesday fixes 78 flaws

On Tuesday was Microsoft’s June 2023 Patch Tuesday, with security updates for 78 flaws, including 38 remote code execution vulnerabilities.

While thirty-eight RCE bugs were fixed, Microsoft only listed six flaws as ‘Critical,’ including denial of service attacks, remote code execution, and privilege elevation.

The number of bugs in each vulnerability category is listed below:

• 17 Elevation of Privilege Vulnerabilities
• 3 Security Feature Bypass Vulnerabilities
• 32 Remote Code Execution Vulnerabilities
• 5 Information Disclosure Vulnerabilities
• 10 Denial of Service Vulnerabilities
• 10 Spoofing Vulnerabilities
• 1 Edge – Chromium Vulnerabilities

This list does not include sixteen Microsoft Edge vulnerabilities previously fixed on June 2nd, 2023.

This Patch Tuesday does not fix any zero-day vulnerabilities or actively exploited bugs, relieving some of the pressure usually felt by Windows admins during this day.

Notable vulnerabilities

While there are no zero-day vulnerabilities in the June 2023 Patch Tuesday, there are some notable flaws listed below:

CVE-2023-29357 – Microsoft SharePoint Server Elevation of Privilege Vulnerability

Microsoft has fixed a privilege elevation vulnerability in Microsoft SharePoint that could allow attackers to assume the privileges of other users, including administrators.

“An attacker who has gained access to spoofed JWT authentication tokens can use them to execute a network attack which bypasses authentication and allows them to gain access to the privileges of an authenticated user.” reads Microsoft’s advisory.

While Microsoft reports that the bug is actively exploited, there are no details on how it was abused.

Microsoft says that Jang (Nguyễn Tiến Giang) of StarLabs SG discovered the vulnerability.

CVE-2023-32031 – Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft has fixed a Microsoft Exchange vulnerability that allows authenticated, remote code execution.

“The attacker for this vulnerability could target the server accounts in an arbitrary or remote code execution. As an authenticated user, the attacker could attempt to trigger malicious code in the context of the server’s account through a network call,” reads Microsoft’s advisory.

Microsoft has also released numerous Microsoft Office updates for vulnerabilities, allowing threat actors to use malicious crafted Excel and OneNote documents to perform remote code execution.

These vulnerabilities are tracked as CVE-2023-33133 (Excel), CVE-2023-33133 (Excel), CVE-2023-33137 (Excel), CVE-2023-33140 (OneNote), CVE-2023-33131 (Outlook).

The OneNote and Outlook flaws require a user to click on a link in the malicious file or email.

The June 2023 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the June 2023 Patch Tuesday updates.

Source: www.bleepingcomputer.com