December this year is full of surprises. Microsoft has decided to close this year with a zero-day vulnerability in Windows kernel and 38 other vulnerabilities.

Adobe however was far more optimistic to address 87 vulnerabilities just in Adobe Reader and Acrobat. Last week Adobe also issued an out-of-bound update for Adobe Flash Player, closing 2 vulnerabilities, including 1 zero-day.

Let’s have a close look at all of these vulnerabilities.

Microsoft

Microsoft patched 39 vulnerabilities. Among them one 0day vulnerability in Windows kernel (CVE-2018-8611). The vulnerability allows a local user to execute arbitrary code on the system with elevated privileges. So far there is no public information about the attack itself. We know only that Microsoft credited Kaspersky Lab for discovery of this issue.

The majority of fixed vulnerabilities are as usual buffer management related errors, as shown below.

Adobe

With Adobe situation is not better. All fixed vulnerabilities are remotely exploitable. 36 vulnerabilities were assigned High security risk, 51 vulnerabilities are considered low-risk errors.

Distribution of vulnerabilities in Adobe Reader and Acrobat is shown below:

Below is a table with the list of all vulnerabilities patched by Microsoft.

Table #1. Vulnerabilities fixed by Microsoft

Table #2. Vulnerabilities fixed by Adobe