Microsoft Fixes 97 Bugs and 1 Zero-Day On April 2023 Patch Tuesday.

Today is Microsoft’s April 2023 Patch Tuesday, and security updates fix 98 bugs, including one actively exploited zero-day vulnerability.

Seven bugs have been labeled “Critical” because they allow remote code execution, which is the worst kind of bug.

Below is a list of each vulnerability category and the number of bugs in each one:

• 20 Elevation of Privilege Vulnerabilities
• 8 Security Feature Bypass Vulnerabilities
• 45 Remote Code Execution Vulnerabilities
• 10 Information Disclosure Vulnerabilities
• 9 Denial of Service Vulnerabilities
• 6 Spoofing Vulnerabilities

This number doesn’t include the seventeen holes that were fixed in Microsoft Edge on April 6th.

You can read our articles about the new Windows 11 KB5025239 cumulative update and the Windows 10 KB5025221 and KB5025229 updates to learn more about the non-security updates that came out today.

One Zero-Day Fixed

This month’s Patch Tuesday fixes an attack that took advantage of a zero-day vulnerability.

Microsoft calls a security hole a “zero-day” if it is known to the public or is being used even though there is no official fix.

In today’s updates, the zero-day vulnerability that is being actively used is:

CVE-2023-28252: Elevation of Privilege Vulnerability in the Windows Common Log File System Driver

Microsoft has fixed a bug in the Windows CLFS driver that could allow a user’s privileges to be raised to SYSTEM, which is the highest user privilege level in Windows.

“If an attacker used this flaw successfully, they could gain SYSTEM privileges,” says Microsoft’s warning.

Microsoft says that Genwei Jiang with Mandiant and Quan Jin with DBAPPSecurity WeBin Lab found the weakness.

But Kaspersky says that they also found and told Microsoft about the CVE-2023-28252 flaw after seeing it used in Nokoyawa ransomware attacks.

Even though they weren’t being used often, Microsoft Office, Word, and Publisher had remote code execution flaws that could be used by opening malicious documents. These flaws were fixed today.

These security holes are known as CVE-2023-28285, CVE-2023-28295, CVE-2023-28287, and CVE-2023-28311.

Since these kinds of vulnerabilities are useful for phishing campaigns, threat actors are likely to try to figure out how they can be used to spread malware.

Because of this, users of Microsoft Office should install today’s security updates as soon as they can.

Recent Updates from Other Companies

Other vendors who released updates in April 2023 include:

• Apple released a security updates to fix two actively exploited zero-days in iOS and macOS.
• Cisco released security updates for multiple products.
• Fortinet released security updates for multiple products.
• Google released the Android April 2023 and Google Chrome security updates.
• SAP has released its April 2023 Patch Day updates.

The April 2023 Patch Tuesday Security Updates

Below is the complete list of resolved vulnerabilities in the April 2023 Patch Tuesday updates.

To access the full description of each vulnerability and the systems it affects, you can view the full report here.

Read More:

Sundar Pichai, The CEO of Google, Says that AI Will Be Added to The Search Engine.

Having Trouble With Your Mac or iPhone? iOS 16.4.1 and macOS 13.3.1 can Help You.

Microsoft Edge Can Now Make Pictures with The Help of AI.