Microsoft June 2024 Patch Tuesday fixes 51 flaws, 18 RCEs

At the moment is Microsoft’s June 2024 Patch Tuesday, which incorporates safety updates for 51 flaws, eighteen distant code execution flaws, and one publicly disclosed zero-day vulnerability.

This Patch Tuesday mounted 18 RCE flaws however just one crucial vulnerability, a distant code execution vulnerability in Microsoft Message Queuing (MSMQ).

The variety of bugs in every vulnerability class is listed under:

• 25 Elevation of Privilege Vulnerabilities
• 18 Distant Code Execution Vulnerabilities
• 3 Data Disclosure Vulnerabilities
• 5 Denial of Service Vulnerabilities

The whole depend of 51 flaws doesn’t embody 7 Microsoft Edge flaws mounted on June third.

To be taught extra in regards to the non-security updates launched at present, you may evaluation our devoted articles on the brand new Home windows 11 KB5039212 replace and the Home windows 10 KB5039211 replace.

One publicly disclosed zero-day

This month’s Patch Tuesday fixes one publicly disclosed zero-day, with no actively exploited flaw mounted at present.

Microsoft classifies a zero-day as a flaw publicly disclosed or actively exploited with no official repair accessible.

The publicly disclosed zero-day vulnerability is the beforehand disclosed ‘Keytrap’ assault within the DNS protocol that Microsoft has now mounted as a part of at present’s updates.

CVE-2023-50868 – MITRE: CVE-2023-50868 NSEC3 closest encloser proof can exhaust CPU

“CVE-2023-50868 is relating to a vulnerability in DNSSEC validation the place an attacker might exploit customary DNSSEC protocols meant for DNS integrity by utilizing extreme assets on a resolver, inflicting a denial of service for respectable customers. MITRE created this CVE on their behalf,” reads the Microsoft advisory.

This flaw was beforehand disclosed in February and patched in quite a few DNS implementations, together with BIND, PowerDNS, Unbound, Knot Resolver, and Dnsmasq.

Different fascinating vulnerabilities mounted this month embody a number of Microsoft Workplace distant code execution flaws, together with Microsoft Outlook RCEs that may be exploited from the preview pane.

Microsoft additionally mounted seven Home windows Kernel privilege elevation flaws that would enable a neighborhood attacker to realize SYSTEM privileges.

Current updates from different corporations

Different distributors who launched updates or advisories in June 2024 embody:

Sadly, we’ll not be linking to SAP’s Patch Tuesday safety updates as they’ve positioned them behind a buyer login.

The June 2024 Patch Tuesday Safety Updates

Beneath is the entire listing of resolved vulnerabilities within the June 2024 Patch Tuesday updates.

To entry the total description of every vulnerability and the methods it impacts, you may view the full report right here.