Microsoft’s Patch Tuesday updates for November 2020 address more than 110 vulnerabilities, including a Windows flaw that was recently disclosed by Google after it was observed being exploited in attacks.
The actively exploited Windows vulnerability is tracked as CVE-2020-17087 and it has been described as a local privilege escalation issue related to the Windows Kernel Cryptography Driver.
Google Project Zero disclosed details of the flaw in late October, several days after its researchers discovered the vulnerability being exploited in attacks alongside a Chrome flaw.
The Chrome vulnerability, identified as CVE-2020-15999, was fixed by Google on October 20 with a Chrome 86 update. It can be exploited for arbitrary code execution by getting the targeted user to access a website hosting a specially crafted font file.
The Windows and Chrome vulnerabilities can be chained to break out of the Chrome sandbox and execute malicious code on the targeted system.
When Google disclosed the Windows bug last month, Microsoft said it had started working on a patch, but noted that its goal is to “help ensure maximum customer protection with minimal customer disruption.”
Microsoft this month patched a total of 17 critical vulnerabilities, most of which can be exploited for remote code execution. Many of the critical flaws impact extensions available in the Microsoft Store.
The vulnerabilities rated important impact Azure Sphere, Windows, browsers, Dynamics 365, Office, SharePoint, Visual Studio and various other products, and they can be exploited for spoofing attacks, DoS attacks, privil ..
Support the originator by clicking the read the rest link below.
