14 July 2021

Microsoft’s July Patch Tuesday addresses over 100 bugs, including 3 zero-days


Microsoft’s July Patch Tuesday addresses over 100 bugs, including 3 zero-days

Microsoft has rolled out a bunch of security updates designed to fix more than 100 vulnerabilities across its multiple products, including three zero-day flaws actively exploited in the wild, as well as a number of publicly disclosed but not exploited issues.

The three zero-day flaws are:

  • CVE-2021-33771 - Windows Kernel Elevation of Privilege Vulnerability. The vulnerability exists due to a boundary error and allows a local user to execute arbitrary code on the target system with elevated privileges.

  • CVE-2021-34448 - Scripting Engine Memory Corruption Vulnerability. The issue exists due to a boundary error when processing HTML content in Microsoft scripting engine. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

  • CVE-2021-31979 - Windows Kernel Elevation of Privilege Vulnerability. The vulnerability exists due to a boundary error in Windows kernel. A local user can run a specially crafted program to trigger memory corruption and execute arbitrary code on the system with elevated privileges.

The Windows maker also patched five previously disclosed, but not exploited, vulnerabilities. They are as follows:

  • CVE-2021-34492 - Windows Certificate Spoofing Vulnerability

  • CVE-2021-34523 - Microsoft Exchange Server Elevation of Privilege Vulnerability

  • CVE-2021-34473 - Microsoft Exchange Server Remote Code Execution Vulnerability

  • CVE-2021-33779 - Windows ADFS Security Feature Bypass Vulnerability

  • CVE-2021-33781 - Active Directory Security Feature Bypass Vulnerability

Microsoft’s July Patch Tuesday also fixes the PrintNightmare (CVE-2021-34527) vulnerability, which came to light last month when Chinese security researchers accidently published technical details and PoC code for what they believed was a Windows Print Spooler bug (CVE-2021-1675), patched as part of Microsoft’s June Patch Tuesday. It turned out that the exploit they published was not actually the same issue fixed by Microsoft.

CVE-2021-34527 includes both remote code execution and a local privilege escalation vector that can be used by hackers to execute commands with SYSTEM privileges on vulnerable Windows systems.

The tech giant said it detected active exploitation attempts targeting the bug.

Users are advised to install Microsoft’s July security updates as soon as possible.

Back to the list

Latest Posts

Malicious actors target Kubernetes clusters via Argo Workflows

Malicious actors target Kubernetes clusters via Argo Workflows

In the observed attacks the threat actors deployed a popular cryptocurrency mining container, kannix/monero-miner.
26 July 2021
Kaseya obtains a decryptor for victims of the REvil ransomware attack

Kaseya obtains a decryptor for victims of the REvil ransomware attack

It's not clear, if the company paid any ransom.
23 July 2021
Chinese cyber-spies use hacked routers in attacks against French organizations

Chinese cyber-spies use hacked routers in attacks against French organizations

The hackers are hijacking home routers to build a proxy botnet in order to hide the origins of their attacks.
22 July 2021