This week Microsoft released a final batch of security updates for 2020 that address at least 58 flaws spanning across multiple company’s products, including Microsoft Windows, PowerPoint, Microsoft Outlook, Microsoft Exchange, Microsoft Kerberos, Azure DevOps, Azure Sphere, and other solutions.
The December 2020 Patch Tuesday provides fixes for a number of remote code execution issues affecting Microsoft Windows NTFS (CVE-2020-17096), Microsoft Exchange, Microsoft SharePoint, Microsoft Excel, Microsoft PowerPoint (CVE-2020-17124), Microsoft Visual Studio (CVE-2020-17148, CVE-2020-17156, CVE-2020-17150).
The company has also addressed a security feature bypass (SFB) bug in Kerberos (CVE-2020-16996), which allows an attacker to gain an unauthorized access to the application and provided a workaround for a spoofing vulnerability affecting the Windows DNS Resolver that allows to spoof the DNS packet which can be cached by the DNS Forwarder or the DNS Resolver.
Valve Software addressed a number of high-risk vulnerabilities impacting the Valve Game Networking Sockets application. The issues are two out-of-bounds write bugs (CVE-2020-6016, CVE-2020-6017) and one stack-based buffer overflow vulnerability (CVE-2020-6018) that could allow a remote attacker to execute arbitrary code using malicious packets.
The OpenSSL Project released a patch to fix a serious flaw that can lead to denial-of-service attacks. The issue, tracked as CVE-2020-1971, is described as a NULL pointer dereference, which a remote attacker can use to trigger denial of service conditions via the API functions TS_RESP_verify_response and TS_RESP_verify_token. If an attacker can control both items being compared then that attacker could trigger a crash.
Adobe's Lightroom and Prelude software received security updates designed to fix a couple of RCE flaws. The first one (CVE-2020-24447) affects Adobe Lightroom v10.0 and earlier. The vulnerability exists due to the application loads DLL libraries in an insecure manner. A remote attacker can place a specially crafted .dll file on a remote SMB fileshare, trick the victim into opening a file, associated with the vulnerable application, and execute arbitrary code on victim's system.
The second flaw (CVE-2020-24440) resides in Adobe Prelude version 9.01 and below and can lead to arbitrary code execution in the context of the current user.
Multiple vulnerabilities have been found in Foxit Reader and PhantomPDF software, six of which (CVE-2020-27860, CVE-2020-13547, CVE-2020-13548, CVE-2020-13557, CVE-2020-13560, CVE-2020-13570) can be exploited for remote code execution.
A serious issue has been reported in Siemens SICAM A8000 Series Automation and remote terminal units. The flaw (CVE-2020-28396) allows an attacker to bypass implemented security measures and elevate privileges on the system. The vulnerable software versions are:
-
SICAM A8000 CP-8000: before 16
-
SICAM A8000 CP-8021: before 16
-
SICAM A8000 CP-8022: before 16
OpenJPEG, an open-source library to encode and decode JPEG 2000 images, contains a high-risk flaw (CVE-2020-27823) that can lead to remote code execution. The vulnerability exists due to a boundary error when processing PNG images in pngtoimage() function in bin/jp2/convertpng.c. A remote attacker can pass specially crafted file to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system. Currently, there is no patch available for this issue.