Microsoft June 2024 Patch Tuesday fixes 51 flaws, 18 RCEs

Right now is Microsoft’s June 2024 Patch Tuesday, which incorporates safety updates for 51 flaws, eighteen distant code execution flaws, and one publicly disclosed zero-day vulnerability.

This Patch Tuesday fastened 18 RCE flaws however just one crucial vulnerability, a distant code execution vulnerability in Microsoft Message Queuing (MSMQ).

The variety of bugs in every vulnerability class is listed beneath:

• 25 Elevation of Privilege Vulnerabilities
• 18 Distant Code Execution Vulnerabilities
• 3 Data Disclosure Vulnerabilities
• 5 Denial of Service Vulnerabilities

The full rely of 51 flaws doesn’t embrace 7 Microsoft Edge flaws fastened on June third.

One publicly disclosed zero-day

This month’s Patch Tuesday fixes one publicly disclosed zero-day, with no actively exploited flaw fastened in the present day.

Microsoft classifies a zero-day as a flaw publicly disclosed or actively exploited with no official repair accessible.

The publicly disclosed zero-day vulnerability is the beforehand disclosed ‘Keytrap’ assault within the DNS protocol that Microsoft has now fastened as a part of in the present day’s updates.

CVE-2023-50868 – MITRE: CVE-2023-50868 NSEC3 closest encloser proof can exhaust CPU

“CVE-2023-50868 is regarding a vulnerability in DNSSEC validation where an attacker could exploit standard DNSSEC protocols intended for DNS integrity by using excessive resources on a resolver, causing a denial of service for legitimate users. MITRE created this CVE on their behalf,” reads the Microsoft advisory.

This flaw was beforehand disclosed in February and patched in quite a few DNS implementations, together with BIND, PowerDNS, Unbound, Knot Resolver, and Dnsmasq.

Different attention-grabbing vulnerabilities fastened this month embrace a number of Microsoft Workplace distant code execution flaws, together with Microsoft Outlook RCEs that may be exploited from the preview pane.

Microsoft additionally fastened seven Home windows Kernel privilege elevation flaws that might enable a neighborhood attacker to realize SYSTEM privileges.

Current updates from different corporations

Different distributors who launched updates or advisories in June 2024 embrace:

Sadly, we are going to now not be linking to SAP’s Patch Tuesday safety updates as they’ve positioned them behind a buyer login.

The June 2024 Patch Tuesday Safety Updates

Beneath is the whole listing of resolved vulnerabilities within the June 2024 Patch Tuesday updates.

To entry the total description of every vulnerability and the techniques it impacts, you’ll be able to view the full report right here.