Microsoft December 2023 Patch Tuesday Fixes 34 Flaws 1 Zero Day

Today is Microsoft’s December 2023 Patch Tuesday, which includes security updates for a total of 34 flaws and one previously disclosed, unpatched vulnerability in AMD CPUs.

While eight remote code execution (RCE) bugs were fixed, Microsoft only rated three as critical. In total, there were four critical vulnerabilities, with one in Power Platform (Spoofing), two in Internet Connection Sharing (RCE), and one in Windows MSHTML Platform (RCE).

The number of bugs in each vulnerability category is listed below:

• 10 Elevation of Privilege Vulnerabilities
• 8 Remote Code Execution Vulnerabilities
• 6 Information Disclosure Vulnerabilities
• 5 Denial of Service Vulnerabilities
• 5 Spoofing Vulnerabilities

The total count of 34 flaws does not include 8 Microsoft Edge flaws fixed on December 7th.

To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5033375 cumulative update and Windows 10 KB5033372 cumulative update.

One publicly disclosed zero-day fixed

This month’s Patch Tuesday fixes one AMD zero-day vulnerability disclosed in August that previously remained unpatched.

The ‘CVE-2023-20588 – AMD: CVE-2023-20588 AMD Speculative Leaks‘ vulnerability is a division-by-zero bug in specific AMD processors that could potentially return sensitive data.

The flaw was disclosed in August 2023, with AMD not providing any fixes other than recommending the following mitigation.

“For affected products, AMD recommends following software development best practices,” reads an AMD bulletin on CVE-2023-20588.

“Developers can mitigate this issue by ensuring that no privileged data is used in division operations prior to changing privilege boundaries. AMD believes that the potential impact of this vulnerability is low because it requires local access. “

As part of today’s December Patch Tuesday updates, Microsoft has released a security update that resolves this bug in impacted AMD processors.

Recent updates from other companies

Other vendors who released updates or advisories in December 2023 include:

• 5Ghoul attack can cause service disruptions in 5G phones with Qualcomm, MediaTek chips
• Atlassian released security updates for four critical remote code execution (RCE) flaws in Confluence, Jira, and Bitbucket.
• Apple backported patches for recent zero-days to older iPhones and some Apple Watch and Apple TV models.
• Cisco released security updates for a Cisco ASA and Firepower flaw allowing IP address spoofing.
• Google released the Android December 2023 security updates with a fix for a critical zero-day.
• SAP has released its December 2023 Patch Day updates.
• Sierra Wireless released security advisors for 21 flaws impacting Sierra OT/IoT routers.
• SLAM side-channel attack steals sensitive data from upcoming CPUs from Intel, AMD, and Arm CPUs.
• VMware fixed a critical authentication bypass in Cloud Director.
• WordPress fixed a POP chain that could lead to RCE attacks.

The December 2023 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the December 2023 Patch Tuesday updates.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.

Original Source