Following its extensive Patch Tuesday release, Microsoft has addressed more than 30 newly identified security vulnerabilities. On Thursday, the tech giant released updates primarily targeting its Office suite to fix these issues.
Addressing Critical RCE Flaws
A significant portion of these patches focuses on high-severity remote code execution (RCE) vulnerabilities. Among these, two dozen flaws were found, including several that could be exploited through the Preview Pane. Attackers typically need to send a malicious file to victims, convincing them to open the document in order to execute the exploit.
Many RCE vulnerabilities are attributed to buffer overflow problems. Other identified defects include off-by-one errors, use-after-free issues, path traversal concerns, and numeric truncation errors.
Comprehensive Security Updates
Word was the primary focus of these security updates, receiving the majority of the patches. However, Excel, Outlook, PowerPoint, and SharePoint were not overlooked, each receiving necessary updates to address specific vulnerabilities.
In addition to fixing RCE flaws, Microsoft also resolved various information disclosure vulnerabilities and a security bypass issue within the Office suite. Moreover, a denial-of-service (DoS) defect in ASP.NET Core, an elevation of privilege in Identity Web, and an information disclosure issue in the Authentication Library (MSAL) for Node.js were also patched.
No Exploits Detected in the Wild
Microsoft has reported that none of these newly patched vulnerabilities have been exploited as zero-day threats. The company also updated several advisories from October 13, informing users that security updates are now available for Office LTSC for Mac 2021 and 2024, as well as for Office 365 for Mac.
These proactive measures by Microsoft are crucial in maintaining the security and integrity of its software, ensuring users are protected against potential cyber threats.
