Microsoft Patches 38 Windows Vulnerabilities

As part of its regular, monthly Patch Tuesday update, Microsoft has released patches for 81 new vulnerabilities, including a zero-day in the .NET Framework. 27 vulnerabilities have been rated as critical, while 39 vulnerabilities allow remote code execution.

For this September, Microsoft is only shipping security updates with patches to the following product groups:

• Browsers (IE and Edge)
• Windows Platforms (Desktop and Server)
• Microsoft Office (including Web Apps), Skype for Business and Exchange Server
• Adobe Flash Players
• The .NET Development Framework

In addition to the critical updates for .NET, Windows and Adobe Flash Player this month, Microsoft has published a short list of known issues found at these knowledge base articles (4038792, 4038793, and 4011050).

The release also includes information of a spoofing vulnerability in the Windows Bluetooth driver (CVE-2017-8628), which has been disclosed as part of the BlueBorne batch of vulnerabilities. The flaw was actually patched silently in July, but Microsoft chose to delay releasing details about it until other vendors could develop and release updates.

And Just in case you’re using Microsoft’s browsers, be it Internet Explorer or Edge in Windows 10, you should know that more than 22 critical vulnerabilities are affecting these applications, with the majority being aimed at the Scripting Engine.

Critical updates to IE and Edge which include:

• Updates to Internet Explorer 11’s navigation bar with search box.
• Addressed issue in Internet Explorer where undo is broken if character conversion is canceled using IME.
• Addressed issue in Internet Explorer where graphics render incorrectly.
• Addressed issue in Internet Explorer where the Delete key functioned improperly.
• Re-release of MS16-087- Security update for Windows print spooler components.
• Security updates to Microsoft Graphics Component, Windows kernel-mode drivers, Windows shell, Microsoft Uniscribe, Microsoft Windows PDF Library, Windows TPM, Windows Hyper-V, Windows kernel, Windows DHCP Server and Internet Explorer.

If you by any reason you are unable to deploy this patch in a timely manner, you may want to review Microsoft’s instructions on mitigating this security vulnerability found here.

The zero-day is tracked under the identifier of CVE-2017-8759 and is a remote code execution vulnerability that affects the .NET Framework.

Below is a table listing of all the 82 security issues fixed this month ,you can use Microsoft’s official Security Update Guide, available here.